🟠 High | Source: Microsoft Security Response Center
A vulnerability in BusyBox wget versions up to 1.3.7 allows attackers to inject arbitrary HTTP headers by embedding carriage return, line feed, or other control characters into the URL path or query string — a technique known as HTTP response splitting or header injection. This can enable request smuggling, session hijacking, or cache poisoning depending on the backend infrastructure. Any Azure or cloud workload using an affected BusyBox version to make outbound HTTP requests may be at risk.
Architect’s Take: Audit container images and lightweight Linux environments (particularly Alpine-based or IoT-adjacent workloads) for BusyBox wget versions at or below 1.3.7, and update to a patched release immediately. Enforce input validation at API gateways and WAF layers to strip raw control characters from HTTP request targets as a defence-in-depth measure.