CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

CVE-2026-76014

BusyBox up to 1.30.1 has a null pointer dereference in networking/wget.c via the -T argument to the FEATURE_WGET_TIMEOUT handler, requiring local access. CVSS 3.3 LOW. A public PoC exists; apply patch 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff from the BusyBox mirror.

CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

CVE-2026-76014: NULL Pointer Dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

PT-2026-78263

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.30.1 Description A null pointer dereference occurs in the FEATURE WGET TIMEOUT handler within the networking/wget.c file. This issue is triggered by the manipulation of the -T argument and requires local access to b...

Linux Distros Unpatched Vulnerability : CVE-2026-76014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOU...

CVE-2026-38753

A flaw was found in Busybox. A use-after-free vulnerability in the awksub function allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted AWK script. This can lead to the unavailability of the Busybox service. Mitigation Mitigation for this issue is either not...

Improper Encoding or Escaping of Output

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getEscapeFunction logic in src/internal/unix/busybox.js. An attacker can reveal the user's home directory and alter how a command interprets an...

CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...

CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...

CVE-2026-73055: Improper Encoding or Escaping of Output

Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...

PT-2026-73059

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

The vulnerability of the data_extract_all.c component in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure.

The vulnerability of the dataextractall.c component of the UNIX utility set in BusyBox is related to external control via a filename or file path. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `strip_unsafe_prefix()` function in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure

The vulnerability of the stripunsafeprefix function in the UNIX command-line utility set of BusyBox is related to external control via a name or file path. Exploiting this vulnerability could allow an attacker to cause a system failure...

EulerOS 2.0 SP11 : busybox (EulerOS-SA-2026-3114)

According to the versions of the busybox packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client udhcpc6 DNSSERVERS option handler in...

EulerOS 2.0 SP11 : busybox (EulerOS-SA-2026-3059)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client udhcpc6 DNSSERVERS option handler in...

EulerOS 2.0 SP13 : busybox (EulerOS-SA-2026-3008)

According to the versions of the busybox packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client udhcpc6 DNSSERVERS option handler in...