CVE-2026-88840
Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
CVE-2026-88840- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-85513
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
EUVD-2026-85513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w878-vhh4-m5pv
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated...
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
GHSA-w878-vhh4-m5pv- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
CVE-2026-88840- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-88840
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
DEBIAN-CVE-2026-88840- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-88840
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- Record
UBUNTU-CVE-2026-88840- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
busyboxDebian:14 |
All versions, plus listed versions 1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8 Show 4 moreShow less1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 |
None known |
busyboxUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1 |
None known |
busyboxUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2 |
None known |
busyboxUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3 Show 5 moreShow less1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1 |
None known |
busyboxUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5 |
None known |
busyboxUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1 |
None known |
busyboxUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1 |
None known |
busyboxUbuntu:26.10 |
All versions, plus listed versions 1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4 |
None known |
busyboxUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.37.0-4ubuntu11:1.37.0-7ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-88840 is a medium vulnerability (CVSS 5.3) in Red Hat Hardened Images, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.