CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. Mitigation Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls...

SUSE CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

CLSA-2026-1790171621 httpd: Fix of 3 CVEs

rebase to 2.4.6-99.0.9.el79.1 - replace the TuxCare backports for CVE-2024-47252, CVE-2025-49812 and CVE-2025-58098 Patch326-328 with the vendor's own patches Patch400-402, which carry the identical upstream changes - all other TuxCare CVE patches are unchanged: Patch300-330 and Patch1000-1014...

CLSA-2026-1790171412 httpd: Fix of 3 CVEs

rebase to 2.4.6-99.0.9.el79.1 - replace the TuxCare backports for CVE-2024-47252, CVE-2025-49812 and CVE-2025-58098 Patch326-328 with the vendor's own patches Patch400-402, which carry the identical upstream changes - all other TuxCare CVE patches are unchanged: Patch300-330 and Patch1000-1014...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-97428

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component of BusyBox incorrectly processes yescrypt $y$ password hashes during Basic Authentication. Instead of verifying the hash, the system treats it as plaintext, which inverts the...

PT-2026-97426

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component in BusyBox handles IP deny rules incorrectly when invalid CIDR prefix lengths are provided. This causes the system to fail open, resulting in a parsed IP with a zeroed mask,...

PT-2026-105035

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88831: Not Failing Securely

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.

Summary The kernel, glibc, expat, RMC daemon, httpd and modhttp2 libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash d...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090073 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE Tenable has extracted the preceding description block directly from the Unity Linu...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003827 advisory. Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003826 advisory. If LimitXMLRequestBody is set to allow request bodies larger than 350MB defaults to 1M on 32 bit systems an integer overflow happens which later causes out of bounds...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090460 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server. Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090049)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090049 advisory. HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with H2PushResource, could lead to an overwrite of memory in the pushing request's pool, leadi...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000273 advisory. Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the...

CVE-2026-66835

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-3869)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : locking/rtmutex: Skip removewaiter when waiter is not enqueuedCVE-2026-53163 ppp: require CAPNETADMIN in target netns for unattached...