CVE-2026-88837

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88837", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-10T09:42:04.559Z", "datePublished": "2026-09-23T17:45:31.496Z", "dateUpdated": "2026-09-25T22:28:21.760Z"}, "containers": {"cna": {"title": "Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "busybox-main", "defaultStatus": "affected", "versions": [{"version": "1.37.0-9.1.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:72111", "name": "RHSA-2026:72111", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-88837", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531351", "name": "RHBZ#2531351", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-23T16:35:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "description": "Authentication Bypass by Primary Weakness", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-305: Authentication Bypass by Primary Weakness", "workarounds": [{"lang": "en", "value": "Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 ($6$) hashes, which are correctly detected. Upstream should update the hash detection logic to recognize the $y$ prefix."}], "timeline": [{"lang": "en", "time": "2026-09-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T16:35:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-25T22:28:21.760Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T18:00:23.871775Z", "id": "CVE-2026-88837", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T18:00:58.072Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T18:00:23.871775Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T18:00:27.062Z"}}], "cna": {"title": "Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication", "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "busybox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T16:35:00.000Z", "value": "Made public."}], "datePublic": "2026-09-23T16:35:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-88837", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531351", "name": "RHBZ#2531351", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 ($6$) hashes, which are correctly detected. Upstream should update the hash detection logic to recognize the $y$ prefix."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "Authentication Bypass by Primary Weakness"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-24T17:58:24.182Z"}, "x_redhatCweChain": "CWE-305: Authentication Bypass by Primary Weakness"}}, "cveMetadata": {"cveId": "CVE-2026-88837", "state": "PUBLISHED", "dateUpdated": "2026-09-24T17:58:24.182Z", "dateReserved": "2026-09-10T09:42:04.559Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-23T17:45:31.496Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.37.0-9.1.hum1", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check."}], "id": "CVE-2026-88837", "lastModified": "2026-09-25T23:16:54.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88837", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T18:00:23.871775Z", "version": "2.0.3"}}]}, "published": "2026-09-23T18:17:10.493", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:72111"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-88837"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531351"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication", "id": "2531351", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531351"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-305", "details": ["BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check."], "mitigation": {"lang": "en:us", "value": "Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 ($6$) hashes, which are correctly detected. Upstream should update the hash detection logic to recognize the $y$ prefix."}, "name": "CVE-2026-88837", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-23T16:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88837\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88837"], "statement": "Fedora 44 uses yescrypt ($y$) as the default password hashing algorithm, so any Fedora system administrator who configures BusyBox httpd with inline password hashes will produce vulnerable configurations by default. However, BusyBox httpd is not used as a web server on Fedora in any standard deployment.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "busybox", "vendor": "busybox"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}], "created": "2026-09-23T20:00:09.002027+00:00", "updated": "2026-09-24T09:10:30.560634+00:00", "vendors": ["busybox", "busybox$PRODUCT$busybox", "redhat", "redhat$PRODUCT$hardened_images"]}