CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

UBUNTU-CVE-2026-88835

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

UBUNTU-CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

UBUNTU-CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

UBUNTU-CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88835

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

CVE-2026-88840

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88840

The BusyBox TLS implementation contains an out-of-bounds read vulnerability in the get_client_hello() function. The issue occurs when the software attempts to parse a truncated ClientHello message , causing the system to read past the end of the input buffer. This vulnerability is specifically as...

EUVD-2026-85513

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88840

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88839

The BusyBox passwd/group utility contains a vulnerability in the tokenize() function where it references a stale endpoint pointer after trimming. This flaw leads to an out-of-bounds write of heap pointers. To mitigate this risk, ensure that /etc/group and /etc/passwd are writable only by root and...

CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

EUVD-2026-85512

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...