CVE-2026-88840: Out-of-bounds Read

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88839: Out-of-bounds Write

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-97429

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description The tokenize function in the passwd/group module references a stale endpoint pointer after a trimming operation. This leads to an out-of-bounds write of heap pointers, which occurs when the...

PT-2026-97427

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description The read package field function in the dpkg utility fails to properly handle NUL terminators when processing malformed .deb packages. This leads to an out-of-bounds heap read, which occurs wh...

CVE-2026-88835: Out-of-bounds Read

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

CVE-2026-88830: Incorrect Calculation of Buffer Size

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message...

PT-2026-97417

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A heap buffer overflow occurs during romfs volume ID parsing when processing crafted filesystem images. The issue stems from the use of unbounded strlen and memcpy operations on...

PT-2026-97430

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description The get client hello function in BusyBox TLS reads past the end of the input buffer when parsing a truncated ClientHello message. This occurs during the initial handshake process of the TLS...

CVE-2026-88831: Not Failing Securely

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88832: Out-of-bounds Write

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

PT-2026-97426

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

PT-2026-97416

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A unit confusion bug in the TLS Montgomery reduction buffer allocation leads to a heap buffer overflow. This occurs during the processing of a crafted ClientKeyExchange message during the...

PT-2026-97428

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2022-000279)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000279 advisory. A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2026-091364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091364 advisory. Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can result in arbitrary code execution. This attack appear to be...

CLEANSTART-2026-EH13874 Security fix for CVE-2022-30065 applied in: busybox 1.35.0-r17

Security vulnerability affects the busybox package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZR79316 Security fix for CVE-2022-48174 applied in: busybox 1.36.1-r2

Security vulnerability affects the busybox package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ND75136 Security fix for CVE-2023-42366 applied in: busybox 1.36.1-r25

Security vulnerability affects the busybox package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PZ89889 Security fix for CVE-2023-42365 applied in: busybox 1.36.1-r29

Security vulnerability affects the busybox package. This issue is resolved in later releases. See references for vulnerability details...