CVE-2026-88829: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Red Hat Red Hat Hardened Images

The vulnerability exists because BusyBox httpd only rewrites the path of the first HTTP request on a TCP connection when configured as a reverse proxy forwarding requests matching a URL prefix. Subsequent pipelined requests are relayed without path rewriting, enabling an attacker to bypass configured path restrictions and access unintended backend server paths. This is a form of HTTP request/response smuggling due to inconsistent interpretation of HTTP requests.

An attacker can access arbitrary paths on the backend server that are not intended to be exposed through the proxy, potentially leading to information disclosure or unauthorized access. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88829 for current remediation guidance. Until a patch is applied, consider disabling the reverse proxy feature or restricting access to trusted clients to mitigate risk.