BusyBox httpd EUVD-2026-100952

Exploitation requires a BusyBox httpd instance configured as a reverse proxy with URL-prefix forwarding to a backend server (the proxy forwarding directive must be enabled); instances running httpd without reverse-proxy configuration are not affected. The flaw depends on HTTP request pipelining over a single TCP connection, since only the first request's path is rewritten while subsequent pipelined requests are relayed unmodified. Per CVSS PR:N/UI:N, no authentication or user interaction is needed by the attacker, but the practical limiting factor is the non-default proxy configuration plus the existence of sensitive backend paths outside the intended prefix that the proxy was relied upon to restrict.

The input CVSS is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, no privileges or user interaction, and a changed scope reflecting that the impact lands on the proxied backend rather than BusyBox httpd itself. However, the impact magnitudes are only Low confidentiality and Low integrity with no availability impact, so this is an access-control/path-restriction bypass, not a full compromise primitive. Critically, the elevated base score is tempered by a configuration prerequisite: it only applies when BusyBox httpd is deployed in reverse-proxy mode with URL-prefix forwarding, which is a non-default, relatively uncommon setup. No EPSS score was provided, so real-world exploitation probability cannot be quantified from this data. The CVE is not listed in CISA KEV and no public exploit code is referenced, and no SSVC decision data (automatable, technical impact, exploitation state) was supplied. Net assessment: a legitimate High-severity request-smuggling issue that is reliable once the vulnerable proxy configuration exists, but it is not a demonstrated mass-exploitation priority - treat it as high priority only in environments that actually run BusyBox httpd as a reverse proxy, and as low practical exposure elsewhere. Note the signal gap: strong CVSS exploitability metrics but no corroborating exploitation signals (EPSS/KEV/POC absent), suggesting potential rather than observed exploitation.

An attacker reaches a BusyBox httpd instance acting as a reverse proxy that forwards only a specific URL prefix to an internal backend. The attacker sends an HTTP request whose first (path-rewritten) line looks legitimate, then pipelines a second request on the same TCP connection; because only the first request's path is rewritten, the second is relayed verbatim to the backend, reaching paths the proxy was meant to hide. No public exploit code is referenced in the provided data, but the technique is a well-understood pipelining/request-smuggling pattern.