CVE-2026-88836
UnknownSummary
This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.
Risk Assessment
No risk, as the vulnerability has been rejected and does not pose a security threat.
Recommendation
No action required, as the CVE has been rejected.
Other vulnerabilities in BusyBox
See all- CVE-2024-58251Low
In netstat in BusyBox through 1.37.0, local users can launch a network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
- CVE-2023-42365Medium
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
- CVE-2023-42364Medium
A use-after-free vulnerability exists in BusyBox v1.36.1 in the evaluate function in awk.c. An attacker can cause a denial of service via a crafted awk pattern.
- CVE-2023-42363Medium
A use-after-free vulnerability was discovered in the xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
- CVE-2017-16544High
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.
- CVE-2011-5325High
Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
- CVE-2016-2147High
Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.
- CVE-2016-6301High
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.
- CVE-2026-88841Low
The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.
- CVE-2025-12220Critical
BLU-IC2 and BLU-IC4 devices include a vulnerable version of BusyBox 1.31.1 with multiple known security vulnerabilities. The issue affects versions through 1.19.5.
Original NVD description (English source)
Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS