Every CVE Search/ Get API key

CVE-2026-88834

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

3.7 LowFix available

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.22%Unchanged since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
CVE-2026-88834
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
EUVDEUVD-2026-98899 3.7

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
EUVD-2026-98899
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g83p-qwfp-8p23 3.7

A flaw was found in BusyBox's httpd web server. When configured with system password...

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
GHSA-g83p-qwfp-8p23
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
NVD 3.7

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
CVE-2026-88834
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSVBELL-CVE-2026-88834 3.7
Record
BELL-CVE-2026-88834
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88834 3.7

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
DEBIAN-CVE-2026-88834
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2026-4526 7.3

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

Record
OESA-2026-4526
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4527 7.3

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

Record
OESA-2026-4527
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4528 7.3

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

Record
OESA-2026-4528
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4529 7.3

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

Record
OESA-2026-4529
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88834 3.7

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
UBUNTU-CVE-2026-88834
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVAZL-108318 No score

CVE-2026-88834 affecting package busybox 1.36.1-27

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Record
AZL-108318
Updated
2026-11-02
OSVopenSUSE-SU-2026:12376-1 No score

busybox-1.38.0-4.1 on GA media

These are all security issues fixed in the busybox-1.38.0-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12376-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Azure Linux:3
 through 1.36.1-27 None known
busybox
Alpaquita:23
 1.35.0-r29 up to 1.35.0-r42
1.35.0-r42
busybox
Alpaquita:25
 1.37.0-r20 up to 1.37.0-r29
1.37.0-r29
busybox
Alpaquita:stream
 1.36.1-r1 up to 1.38.0-r6
1.38.0-r6
busybox
BellSoft Hardened Containers:23
 1.35.0-r29 up to 1.35.0-r42
1.35.0-r42
busybox
BellSoft Hardened Containers:25
 1.37.0-r20 up to 1.37.0-r29
1.37.0-r29
busybox
BellSoft Hardened Containers:stream
 1.36.1-r1 up to 1.38.0-r6
1.38.0-r6
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:14
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
Show 13 moreShow less
Affected packages
PackageAffectedFixed
busybox
openEuler:24.03-LTS-SP3
From an advisory covering 7 CVEs
 before 1.36.1-25.oe2403sp3
1.36.1-25.oe2403sp3
busybox
openEuler:24.03-LTS-SP4
From an advisory covering 7 CVEs
 before 1.36.1-25.oe2403sp4
1.36.1-25.oe2403sp4
busybox
openEuler:22.03-LTS-SP4
From an advisory covering 7 CVEs
 before 1.34.1-38.oe2203sp4
1.34.1-38.oe2203sp4
busybox
openEuler:24.03-LTS-SP1
From an advisory covering 7 CVEs
 before 1.36.1-25.oe2403sp1
1.36.1-25.oe2403sp1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 1.38.0-4.1
1.38.0-4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88834 is a low vulnerability (CVSS 3.7) in Red Hat Hardened Images, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in busybox 1.35.0-r42.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open