CVE-2026-88840

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. Mitigation Do not use BusyBox sslserver in production deployments. Upstream should add a bounds check to verify len 0 before reading the compression-methods length byte...

CVE-2026-88830

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. Mitigation Do not use the BusyBox sslserver applet in production environments. Use a well-maintained TLS implementation such...