CVE-2026-88829

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨High - BusyBox Vulnerabilities dpkg-deb Arbitrary Write (CVE-2026-90954) Extraction mishandles symlinks in data.tar archives, allowing arbitrary file writes outside the target directory. 👉Affected: dpkg-deb builds. Check: "busybox --list | grep dpkg-deb" httpd Request Smuggling (CVE-2026-88829) Mishandled pipelined requests let a smuggled 2nd request bypass proxy path restrictions to reach the backend. 👉Affected: httpd reverse proxy. Mitigate: Remove "P:" lines or use a full proxy (Nginx/HAProxy) in front.
0000050
321 followersView on X

Explore more

Back to dashboard