CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP...
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2025-50804
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
EUVD-2025-50804- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-48hw-cv6f-mcpj
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP...
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
GHSA-48hw-cv6f-mcpj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVBELL-CVE-2025-60876
- Record
BELL-CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
DEBIAN-CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1879
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-1879- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1880
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-1880- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1881
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-1881- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-2700
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-2700- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-2701
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-2701- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-2702
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)
- Record
OESA-2026-2702- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:7418
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7418- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
UBUNTU-CVE-2025-60876- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-69985 No score
CVE-2025-60876 affecting package busybox 1.35.0-18
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
AZL-69985- Updated
- 2026-11-02
OSVAZL-70043 No score
CVE-2025-60876 affecting package busybox 1.36.1-28
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
- Record
AZL-70043- Updated
- 2026-11-05
OSVopenSUSE-SU-2025:15834-1 No score
busybox-1.37.0-8.1 on GA media
These are all security issues fixed in the busybox-1.37.0-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15834-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20090-1 No score
Security update for busybox
This update for busybox fixes the following issues:
Security fixes:
- CVE-2025-60876: HTTP request header injection in wget (bsc#1253245).
- CVE-2025-46394: Fixed tar hidden files via escape sequence (bsc#1241661).
Other fixes:
- Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
- Fix unshare -mrpf sh core dump on ppc64le (bsc#1249237)
- Record
openSUSE-SU-2026:20090-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0235-1 No score
Security update for busybox
This update for busybox fixes the following issues:
Security issues:
- CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661)
- CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245)
Other issues:
- Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
- Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237)
- Record
SUSE-SU-2026:0235-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0236-1 No score
Security update for busybox
This update for busybox fixes the following issues:
This update for busybox fixes the following issues:
Security issues:
- CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661)
- CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245)
Other issues:
- Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
- Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237)
- Fixed adduser inside containers on an SELinux host (bsc#1247779)
- Record
SUSE-SU-2026:0236-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0872-1 No score
Security update for busybox
This update for busybox fixes the following issues:
- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
- CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
- Record
SUSE-SU-2026:0872-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0892-1 No score
Security update for busybox
This update for busybox fixes the following issues:
- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
- CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
- Record
SUSE-SU-2026:0892-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20134-1 No score
Security update for busybox
This update for busybox fixes the following issues:
Security fixes:
- CVE-2025-60876: HTTP request header injection in wget (bsc#1253245).
- CVE-2025-46394: Fixed tar hidden files via escape sequence (bsc#1241661).
Other fixes:
- Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
- Fix unshare -mrpf sh core dump on ppc64le (bsc#1249237)
- Record
SUSE-SU-2026:20134-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
busyboxAzure Linux:2 |
through 1.35.0-18 | None known |
busyboxAzure Linux:3 |
through 1.36.1-28 | None known |
busyboxAlpaquita:23 |
1.35.0-r29 up to 1.35.0-r38 | 1.35.0-r38 |
busyboxAlpaquita:25 |
1.37.0-r20 up to 1.37.0-r26 | 1.37.0-r26 |
busyboxAlpaquita:stream |
1.36.1-r1 up to 1.37.0-r31 | 1.37.0-r31 |
busyboxBellSoft Hardened Containers:23 |
1.35.0-r29 up to 1.35.0-r38 | 1.35.0-r38 |
busyboxBellSoft Hardened Containers:25 |
1.37.0-r20 up to 1.37.0-r26 | 1.37.0-r26 |
busyboxBellSoft Hardened Containers:stream |
1.36.1-r1 up to 1.37.0-r31 | 1.37.0-r31 |
busyboxDebian:12 |
All versions, plus listed versions 1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2 Show 23 moreShow less1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 |
None known |
busyboxDebian:13 |
All versions, plus listed versions 1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8 Show 4 moreShow less1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 |
None known |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
busyboxDebian:14 |
before 1:1.37.0-8, plus listed versions 1:1.37.0-61:1.37.0-7 |
1:1.37.0-8 |
busyboxopenEuler:24.03-LTS-SP1 |
before 1.36.1-15.oe2403sp1 | 1.36.1-15.oe2403sp1 |
busyboxopenEuler:24.03-LTS-SP2 |
before 1.36.1-15.oe2403sp2 | 1.36.1-15.oe2403sp2 |
busyboxopenEuler:24.03-LTS |
before 1.36.1-15.oe2403 | 1.36.1-15.oe2403 |
busyboxopenEuler:20.03-LTS-SP4 |
before 1.31.1-30.oe2003sp4 | 1.31.1-30.oe2003sp4 |
busyboxopenEuler:22.03-LTS-SP4 |
before 1.34.1-30.oe2203sp4 | 1.34.1-30.oe2203sp4 |
busyboxopenEuler:24.03-LTS-SP3 |
before 1.36.1-16.oe2403sp3 | 1.36.1-16.oe2403sp3 |
busyboxRed Hat:hummingbird:1 |
before 0:1.37.0-7.1.hum1 | 0:1.37.0-7.1.hum1 |
busybox-petitbootRed Hat:hummingbird:1 |
before 0:1.37.0-7.1.hum1 | 0:1.37.0-7.1.hum1 |
busybox-sharedRed Hat:hummingbird:1 |
before 0:1.37.0-7.1.hum1 | 0:1.37.0-7.1.hum1 |
busyboxSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 2 CVEs |
before 1.37.0-150700.18.10.1 | 1.37.0-150700.18.10.1 |
busyboxSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busyboxopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.37.0-150500.10.14.1 | 1.37.0-150500.10.14.1 |
busybox-linksopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.37.0-150500.7.9.1 | 1.37.0-150500.7.9.1 |
busyboxSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 8 CVEs |
before 1.35.0-150400.3.14.1 | 1.35.0-150400.3.14.1 |
busyboxSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.35.0-150400.3.14.1 | 1.35.0-150400.3.14.1 |
busyboxSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.35.0-150400.3.14.1 | 1.35.0-150400.3.14.1 |
busyboxSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 8 CVEs |
before 1.35.0-150400.3.14.1 | 1.35.0-150400.3.14.1 |
busyboxSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 8 CVEs |
before 1.35.0-10.3.1 | 1.35.0-10.3.1 |
busyboxSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 8 CVEs |
before 1.35.0-10.3.1 | 1.35.0-10.3.1 |
busyboxSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 1.37.0-160000.4.1 | 1.37.0-160000.4.1 |
busyboxSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 1.37.0-160000.4.1 | 1.37.0-160000.4.1 |
busyboxUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1 |
None known |
busyboxUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2 |
None known |
busyboxUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3 Show 5 moreShow less1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1 |
None known |
busyboxUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5 |
None known |
busyboxUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1 |
None known |
busyboxUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1 |
None known |
busyboxUbuntu:25.10 |
All versions, plus listed versions 1:1.37.0-4ubuntu1 |
None known |
busyboxUbuntu:26.10 |
All versions, plus listed versions 1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4 |
None known |
busyboxUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.37.0-4ubuntu11:1.37.0-7ubuntu1 |
None known |
busyboxopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.37.0-8.1 | 1.37.0-8.1 |
busyboxopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 1.37.0-160000.4.1 | 1.37.0-160000.4.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sirredbeard/CVE-2025-60876 | 2026-06-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-60876 is a medium vulnerability (CVSS 6.5) in Busybox, published November 10, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in busybox 1.35.0-r38.
References
lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm
gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092
cert-portal.siemens.com/productcert/html/ssa-253495.html
nvd.nist.gov/vuln/detail/CVE-2025-60876
github.com/advisories/GHSA-48hw-cv6f-mcpj
Show 42 moreShow less
docs.bell-sw.com/security/cves/CVE-2025-60876
security-tracker.debian.org/tracker/CVE-2025-60876
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1879
access.redhat.com/errata/RHSA-2026:7418
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7418.json
bugzilla.redhat.com/show_bug.cgi?id=2413825
cve.org/CVERecord?id=CVE-2025-60876
suse.com/support/update/announcement/2026/suse-su-20260235-1
bugzilla.suse.com/1236670
ubuntu.com/security/CVE-2025-60876