This vulnerability arises because BusyBox httpd does not fail securely when IP deny rules contain invalid CIDR prefix lengths. Instead of blocking access, the server parses the IP with a zeroed mask, effectively matching no clients and allowing unintended access. This is a failure to enforce intended access restrictions, categorized under CWE-636 (Not Failing Securely). The issue requires a misconfiguration in the httpd configuration file and is specific to BusyBox httpd as shipped in Red Hat Hardened Images. Red Hat advises auditing all BusyBox httpd configuration files for valid CIDR prefix lengths and recommends using network-level access controls as the primary enforcement mechanism.

The vulnerability allows bypassing of intended IP-based access restrictions in BusyBox httpd, potentially permitting unauthorized network clients to access protected content. There is no impact on integrity or availability, and no privileges or user interaction are required for exploitation. The overall confidentiality impact is low.

Red Hat advises auditing all BusyBox httpd configuration files to ensure CIDR prefix lengths are syntactically valid. Additionally, network-level access controls such as iptables or nftables should be implemented as the primary enforcement layer rather than relying solely on application-level ACLs. No official fix or patch status is provided in the advisory; therefore, patch status is not yet confirmed—check the Red Hat advisory for updates.