CVE-2026-88835

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

The Swiss Army Knife of Embedded Linux

Security Fix(es):

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831)

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832)

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837)

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839)

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842)

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

These are all security issues fixed in the busybox-1.38.0-3.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).

This update for busybox fixes the following issues:

• CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message (bsc#1282575).
• CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
• CVE-2026-88832: romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576).
• CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551).
• CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
• CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
• CVE-2026-88841: OOB read and silent memory corruption of the status file due to write_status_file() failing to reset the field_start cursor between package stanzas (bsc#1282653).