Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 67

Export CSV
CVE-2026-124745

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Red Hat Redhat
Products
Busybox Enterprise Linux Enterprise Linux and 3 more
CVE-2026-124746

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Red Hat Redhat
Products
Busybox Enterprise Linux Enterprise Linux and 3 more
CVE-2026-88833

Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hummingbird Rhel Els
CVE-2026-108119

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Enterprise Linux Hardened Images and 2 more
CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2026-88829

Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-90954

Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88838

Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hummingbird
CVE-2026-88834

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hummingbird
CVE-2023-42366

busybox: A heap-buffer-overflow

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2026-88840

Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88839

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88835

Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88837

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88831

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88832

Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hardened Images Hummingbird
CVE-2026-88841

busybox: busybox: dpkg write_status_file() stale cursor causes out-of-bounds read and status file corruption

BusyBox dpkg write_status_file() does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages.

CVSS 3.1 · 3.3 Low EPSS n/a KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2026-88830

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat
Products
Busybox Hummingbird
CVE-2026-76014

BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2026-38753

Use-After-Free in BusyBox Awk Leading to Denial of Service

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox