CVE-2026-88833
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
CVE-2026-88833 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 6, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in busybox 1.35.0-r42.
- Severity
- 6.5 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.19%EPSS, 8th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.35.0-r42busybox +21 more
Description
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
busyboxAzure Linux:3 | through 1.36.1-28 | None known |
busyboxAlpaquita:23 | 1.35.0-r29 up to 1.35.0-r42 | 1.35.0-r42 |
busyboxAlpaquita:25 | 1.37.0-r20 up to 1.37.0-r29 | 1.37.0-r29 |
busyboxAlpaquita:stream | 1.36.1-r1 up to 1.38.0-r6 | 1.38.0-r6 |
busyboxBellSoft Hardened Containers:23 | 1.35.0-r29 up to 1.35.0-r42 | 1.35.0-r42 |
busyboxBellSoft Hardened Containers:25 | 1.37.0-r20 up to 1.37.0-r29 | 1.37.0-r29 |
busyboxBellSoft Hardened Containers:stream | 1.36.1-r1 up to 1.38.0-r6 | 1.38.0-r6 |
busyboxDebian:12 | All versions, plus listed versions 1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2 Show 23 moreShow less1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 | None known |
busyboxDebian:13 | All versions, plus listed versions 1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8 Show 4 moreShow less1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 | None known |
busyboxDebian:14 | All versions, plus listed versions 1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8 Show 4 moreShow less1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 | None known |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
busyboxRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 1:1.37.0-9.5.hum1 | 1:1.37.0-9.5.hum1 |
busybox-petitbootRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 1:1.37.0-9.5.hum1 | 1:1.37.0-9.5.hum1 |
busybox-sharedRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 1:1.37.0-9.5.hum1 | 1:1.37.0-9.5.hum1 |
busyboxUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1 | None known |
busyboxUbuntu:Pro:16.04:LTS | All versions, plus listed versions 1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2 | None known |
busyboxUbuntu:Pro:18.04:LTS | All versions, plus listed versions 1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3 Show 5 moreShow less1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1 | None known |
busyboxUbuntu:20.04:LTS | All versions, plus listed versions 1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5 | None known |
busyboxUbuntu:22.04:LTS | All versions, plus listed versions 1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1 | None known |
busyboxUbuntu:24.04:LTS | All versions, plus listed versions 1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1 | None known |
busyboxUbuntu:26.10 | All versions, plus listed versions 1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4 | None known |
busyboxUbuntu:26.04:LTS | All versions, plus listed versions 1:1.37.0-4ubuntu11:1.37.0-7ubuntu1 | None known |
busyboxopenSUSE:Tumbleweed From an advisory covering 8 CVEs | before 1.38.0-4.1 | 1.38.0-4.1 |
What each source reports
CVE List Score used
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
CVE-2026-88833- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-13
EUVDEUVD-2026-98897
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
EUVD-2026-98897- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-hg7w-cw6w-99w3
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client...
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
GHSA-hg7w-cw6w-99w3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-13
NVD
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
CVE-2026-88833- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-13
OSVBELL-CVE-2026-88833
- Record
BELL-CVE-2026-88833- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-88833
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
DEBIAN-CVE-2026-88833- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
Show 4 moreShow less
OSVRHSA-2026:99577
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:99577- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-88833
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
UBUNTU-CVE-2026-88833- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-108321No score
CVE-2026-88833 affecting package busybox 1.36.1-28
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
- Record
AZL-108321- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12376-1No score
busybox-1.38.0-4.1 on GA media
These are all security issues fixed in the busybox-1.38.0-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12376-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List, EUVD, NVD, OSV | |
| products | CVE List | |
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:99577
bugzilla.redhat.com/show_bug.cgi?id=2531347
nvd.nist.gov/vuln/detail/CVE-2026-88833
github.com/advisories/GHSA-hg7w-cw6w-99w3
docs.bell-sw.com/security/cves/CVE-2026-88833
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-88833
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99577.json
cve.org/CVERecord?id=CVE-2026-88833
ubuntu.com/security/CVE-2026-88833
suse.com/security/cve/CVE-2024-58251