CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

The BusyBox httpd component is vulnerable to an authentication bypass because it incorrectly treats yescrypt ($y$) password hashes as plaintext during Basic Authentication . This flaw inverts the authentication check, potentially allowing unauthorized access. To mitigate this risk, users are advi...

EUVD-2026-85511

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. Mitigation Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 $6$ hashes, which are correctly detected...

CVE-2026-55556

A flaw was found in Rsyslog, a system for log processing, specifically in its optional imhttp module. An attacker can remotely trigger a heap buffer overflow by sending a specially crafted, oversized credential to an imhttp endpoint configured for Basic Authentication. This can lead to a system...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-97428

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component of BusyBox incorrectly processes yescrypt $y$ password hashes during Basic Authentication. Instead of verifying the hash, the system treats it as plaintext, which inverts the...

AZL-104994 CVE-2026-55556 affecting package rsyslog 8.2308.0-7

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 are affected by a heap buffer overflow in the optional imhttp module's parse_auth_header function (contrib/imhttp/imhttp.c). When an HTTP Basic Authorization value exceeds the fixed work buffer, calloc(0, len) allocates a zero-byte heap buffer that is th...

CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-55556

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

PT-2026-102716

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse auth header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passe...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-92751

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92751

CMAK (Yahoo's Kafka management tool) through version 3.0.0.6 lacks a cross-site request forgery (CSRF) filter, enabling attackers to craft hidden forms that trigger state-changing actions on behalf of authenticated operators. Destructive endpoints such as topic deletion and cluster configuration ...

EUVD-2026-81023

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...