CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

CVE-2026-76014

BusyBox up to 1.30.1 has a null pointer dereference in networking/wget.c via the -T argument to the FEATURE_WGET_TIMEOUT handler, requiring local access. CVSS 3.3 LOW. A public PoC exists; apply patch 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff from the BusyBox mirror.

EUVD-2026-62225

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...

PT-2026-78263

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE WGET TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-76014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOU...

CVE-2026-38753

A flaw was found in Busybox. A use-after-free vulnerability in the awksub function allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted AWK script. This can lead to the unavailability of the Busybox service. Mitigation Mitigation for this issue is either not...

CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...

PT-2026-73059

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

The vulnerability of the data_extract_all.c component, a command-line utility for UNIX tools from BusyBox, allows a hacker to trigger a service failure.

The vulnerability of the dataextractall.c component of the UNIX utility set in BusyBox is related to external control via a filename or file path. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `strip_unsafe_prefix()` function in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure

The vulnerability of the stripunsafeprefix function in the UNIX command-line utility set of BusyBox is related to external control via a name or file path. Exploiting this vulnerability could allow an attacker to cause a service failure...

CLEANSTART-2026-AG84392 Security fixes in busybox 1.36.1-r2

Package busybox version 1.36.1-r2 fixes 1 vulnerabilities: CVE-2022-48174...

CLEANSTART-2026-SU97582 Security fixes in busybox 1.36.1-r25

Package busybox version 1.36.1-r25 fixes 1 vulnerabilities: CVE-2023-42366...

CVE-2026-38755 affecting package busybox for versions less than 1.36.1-25

CVE-2026-38755 affecting package busybox for versions less than 1.36.1-25. A patched version of the package is available...

CVE-2026-38754 affecting package busybox for versions less than 1.36.1-25

CVE-2026-38754 affecting package busybox for versions less than 1.36.1-25. A patched version of the package is available...

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

...

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

...

busybox: BusyBox: Denial of Service via crafted AWK script

A flaw was found in BusyBox. This vulnerability, a stack overflow in the evaluate function, allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted AWK script. A Denial of Service attack can make the affected system or application unavailable to legitimate users...