Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    BELL-CVE-2026-88842 (CVE-2026-88842)

    Vulnerability from osv_bellsoft – Published: 2026-10-20 06:09 – Updated: 2026-10-21 06:01 – Source website
    Withdrawn 2026-10-21 VLAI
    Summary
    CVE-2026-88842 does not affect BellSoft software
    Severity
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    References
    To clipboard 

    {
  "id": "BELL-CVE-2026-88842",
  "modified": "2026-10-21T06:01:43.23886Z",
  "published": "2026-10-20T06:09:07.108138Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-88842"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CVE-2026-88842 does not affect BellSoft software",
  "upstream": [
    "CVE-2026-88842"
  ],
  "withdrawn": "2026-10-21T06:01:43.23886Z"
}

    FKIE_CVE-2026-88842

    Vulnerability from fkie_nvd - Published: 2026-10-14 11:17 - Updated: 2026-10-15 20:17
    Severity
    3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    Summary
    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
    References
    secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2026:81391
    secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2026-88842
    secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2531355
    Impacted products
    Vendor Product Version
    To clipboard 

    {
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-9.4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption."
    }
  ],
  "id": "CVE-2026-88842",
  "lastModified": "2026-10-15T20:17:15.873",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-88842",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-14T10:52:03.773503Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-14T11:17:06.993",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:81391"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-88842"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

    MSRC_CVE-2026-88842

    Vulnerability from csaf_microsoft - Published: 2026-10-21 01:10 - Updated: 2026-10-21 01:10
    Summary
    Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
    Scope
    1 vulnerability in this advisory, including CVE-2026-88842.
    CVE-2026-88842
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    Known affected: 1 product
    Open the full advisory

    OESA-2026-4526 (CVE-2026-88831)

    Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source website
    VLAI
    Summary
    busybox security update
    Details

    The Swiss Army Knife of Embedded Linux

    Security Fix(es):

    BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

    BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

    BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

    BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "busybox-1.36.1-25.oe2403sp3.aarch64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp3.aarch64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp3.aarch64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "busybox-help-1.36.1-25.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "busybox-1.36.1-25.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "busybox-1.36.1-25.oe2403sp3.x86_64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp3.x86_64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp3.x86_64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "busybox",
        "purl": "pkg:rpm/openEuler/busybox\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.1-25.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Swiss Army Knife of Embedded Linux\r\n\r\nSecurity Fix(es):\n\nBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)\n\nBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)\n\nA flaw was found in BusyBox\u0026apos;s httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)\n\nBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)\n\nBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)\n\nBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)\n\nA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)",
  "id": "OESA-2026-4526",
  "modified": "2026-10-22T14:36:11Z",
  "published": "2026-10-22T14:36:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4526"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88834"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "busybox security update",
  "upstream": [
    "CVE-2026-88831",
    "CVE-2026-88832",
    "CVE-2026-88834",
    "CVE-2026-88835",
    "CVE-2026-88837",
    "CVE-2026-88839",
    "CVE-2026-88842"
  ]
}

    OESA-2026-4527 (CVE-2026-88831)

    Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source website
    VLAI
    Summary
    busybox security update
    Details

    The Swiss Army Knife of Embedded Linux

    Security Fix(es):

    BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

    BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

    BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

    BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "busybox-1.36.1-25.oe2403sp4.aarch64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp4.aarch64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp4.aarch64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp4.aarch64.rpm"
        ],
        "noarch": [
          "busybox-help-1.36.1-25.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "busybox-1.36.1-25.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "busybox-1.36.1-25.oe2403sp4.x86_64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp4.x86_64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp4.x86_64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "busybox",
        "purl": "pkg:rpm/openEuler/busybox\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.1-25.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Swiss Army Knife of Embedded Linux\r\n\r\nSecurity Fix(es):\n\nBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)\n\nBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)\n\nA flaw was found in BusyBox\u0026apos;s httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)\n\nBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)\n\nBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)\n\nBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)\n\nA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)",
  "id": "OESA-2026-4527",
  "modified": "2026-10-22T14:36:12Z",
  "published": "2026-10-22T14:36:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4527"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88834"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "busybox security update",
  "upstream": [
    "CVE-2026-88831",
    "CVE-2026-88832",
    "CVE-2026-88834",
    "CVE-2026-88835",
    "CVE-2026-88837",
    "CVE-2026-88839",
    "CVE-2026-88842"
  ]
}

    OESA-2026-4528 (CVE-2026-88831)

    Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source website
    VLAI
    Summary
    busybox security update
    Details

    The Swiss Army Knife of Embedded Linux

    Security Fix(es):

    BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

    BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

    BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

    BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "busybox-1.34.1-38.oe2203sp4.aarch64.rpm",
          "busybox-debuginfo-1.34.1-38.oe2203sp4.aarch64.rpm",
          "busybox-debugsource-1.34.1-38.oe2203sp4.aarch64.rpm",
          "busybox-help-1.34.1-38.oe2203sp4.aarch64.rpm",
          "busybox-petitboot-1.34.1-38.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "busybox-1.34.1-38.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "busybox-1.34.1-38.oe2203sp4.x86_64.rpm",
          "busybox-debuginfo-1.34.1-38.oe2203sp4.x86_64.rpm",
          "busybox-debugsource-1.34.1-38.oe2203sp4.x86_64.rpm",
          "busybox-help-1.34.1-38.oe2203sp4.x86_64.rpm",
          "busybox-petitboot-1.34.1-38.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "busybox",
        "purl": "pkg:rpm/openEuler/busybox\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34.1-38.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Swiss Army Knife of Embedded Linux\r\n\r\nSecurity Fix(es):\n\nBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)\n\nBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)\n\nA flaw was found in BusyBox\u0026apos;s httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)\n\nBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)\n\nBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)\n\nBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)\n\nA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)",
  "id": "OESA-2026-4528",
  "modified": "2026-10-22T14:36:13Z",
  "published": "2026-10-22T14:36:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88834"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "busybox security update",
  "upstream": [
    "CVE-2026-88831",
    "CVE-2026-88832",
    "CVE-2026-88834",
    "CVE-2026-88835",
    "CVE-2026-88837",
    "CVE-2026-88839",
    "CVE-2026-88842"
  ]
}

    OESA-2026-4529 (CVE-2026-88831)

    Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source website
    VLAI
    Summary
    busybox security update
    Details

    The Swiss Army Knife of Embedded Linux

    Security Fix(es):

    BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

    BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

    BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

    BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "busybox-1.36.1-25.oe2403sp1.aarch64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp1.aarch64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp1.aarch64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "busybox-help-1.36.1-25.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "busybox-1.36.1-25.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "busybox-1.36.1-25.oe2403sp1.x86_64.rpm",
          "busybox-debuginfo-1.36.1-25.oe2403sp1.x86_64.rpm",
          "busybox-debugsource-1.36.1-25.oe2403sp1.x86_64.rpm",
          "busybox-petitboot-1.36.1-25.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "busybox",
        "purl": "pkg:rpm/openEuler/busybox\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.1-25.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Swiss Army Knife of Embedded Linux\r\n\r\nSecurity Fix(es):\n\nBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)\n\nBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)\n\nA flaw was found in BusyBox\u0026apos;s httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)\n\nBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)\n\nBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)\n\nBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)\n\nA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)",
  "id": "OESA-2026-4529",
  "modified": "2026-10-22T14:36:14Z",
  "published": "2026-10-22T14:36:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4529"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88834"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88842"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "busybox security update",
  "upstream": [
    "CVE-2026-88831",
    "CVE-2026-88832",
    "CVE-2026-88834",
    "CVE-2026-88835",
    "CVE-2026-88837",
    "CVE-2026-88839",
    "CVE-2026-88842"
  ]
}

    RHSA-2026:81391

    Vulnerability from csaf_redhat - Published: 2026-10-12 17:14 - Updated: 2026-10-15 19:20
    Summary
    Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
    Severity
    Moderate
    Scope
    2 vulnerabilities in this advisory, including CVE-2026-88842.
    CVE-2026-88842

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    Fixed: 10 products
    https://access.redhat.com/errata/RHSA-2026:81391
    Open the full advisory

    UBUNTU-CVE-2026-88842 (CVE-2026-88842)

    Vulnerability from osv_ubuntu – Published: 2026-10-15 00:00 – Updated: 2026-10-15 00:00 – Source website
    VLAI
    Details

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

    Severity
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    N/A (UNKNOWN)
    medium
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.21.0-1ubuntu1.4+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.20.0-8.1ubuntu1",
        "1:1.20.0-9ubuntu1",
        "1:1.20.0-9ubuntu2",
        "1:1.21.0-1ubuntu1",
        "1:1.21.0-1ubuntu1.4",
        "1:1.21.0-1ubuntu1.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.22.0-15ubuntu1.4+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-15ubuntu1",
        "1:1.22.0-15ubuntu1.4",
        "1:1.22.0-15ubuntu1.4+esm1",
        "1:1.22.0-15ubuntu1.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.27.2-2ubuntu3.4+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-19ubuntu2",
        "1:1.27.2-1ubuntu3",
        "1:1.27.2-1ubuntu4",
        "1:1.27.2-2ubuntu2",
        "1:1.27.2-2ubuntu3",
        "1:1.27.2-2ubuntu3.1",
        "1:1.27.2-2ubuntu3.2",
        "1:1.27.2-2ubuntu3.3",
        "1:1.27.2-2ubuntu3.4",
        "1:1.27.2-2ubuntu3.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-4ubuntu6.5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-4ubuntu4",
        "1:1.30.1-4ubuntu5",
        "1:1.30.1-4ubuntu6",
        "1:1.30.1-4ubuntu6.1",
        "1:1.30.1-4ubuntu6.2",
        "1:1.30.1-4ubuntu6.3",
        "1:1.30.1-4ubuntu6.4",
        "1:1.30.1-4ubuntu6.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-7ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-6ubuntu3",
        "1:1.30.1-7ubuntu1",
        "1:1.30.1-7ubuntu2",
        "1:1.30.1-7ubuntu3",
        "1:1.30.1-7ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.36.1-6ubuntu3.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.36.1-3ubuntu1",
        "1:1.36.1-6ubuntu1",
        "1:1.36.1-6ubuntu3",
        "1:1.36.1-6ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.38.0-3ubuntu4"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.38.0-3ubuntu4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.38.0-3ubuntu4?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-7ubuntu1",
        "1:1.37.0-10.1ubuntu2",
        "1:1.37.0-10.1ubuntu3",
        "1:1.38.0-3ubuntu1",
        "1:1.38.0-3ubuntu3",
        "1:1.38.0-3ubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.37.0-7ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.37.0-7ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-4ubuntu1",
        "1:1.37.0-7ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.",
  "id": "UBUNTU-CVE-2026-88842",
  "modified": "2026-10-15T00:00:00Z",
  "published": "2026-10-15T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88842"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88842"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-88842"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-88842"
  ]
}