Catalogo CVE

CVE-2026-26157

busybox affected and fixed versions

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

Gravità: High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Feb 11, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.73% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	busybox	`1:1.37.0-10.1`	FixedDistribution-reported fixed boundary	[CVE-2026-26157]
Debiansid	busybox	`1:1.38.0-3`	Fixed	[CVE-2026-26157]
Debianforky	busybox	`1:1.37.0-10.1`	FixedDistribution-reported fixed boundary	[CVE-2026-26157]
Debianforky	busybox	`1:1.38.0-3`	Fixed	[CVE-2026-26157]

Showing 4 fix observations. All 22 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	busybox	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	busybox	Not reported	AffectedDistribution reports no fix	[CVE-2026-26157]
Debianbookworm	busybox	`1:1.35.0-4+deb12u1`	Affected	[CVE-2026-26157]
Debianforky	busybox	`1:1.37.0-10.1`	FixedDistribution-reported fixed boundary	[CVE-2026-26157]
Debianforky	busybox	`1:1.38.0-3`	Fixed	[CVE-2026-26157]
Debiansid	busybox	`1:1.37.0-10.1`	FixedDistribution-reported fixed boundary	[CVE-2026-26157]
Debiansid	busybox	`1:1.38.0-3`	Fixed	[CVE-2026-26157]
Debiantrixie	busybox	Not reported	AffectedDistribution reports no fix	[CVE-2026-26157]
Debiantrixie	busybox	`1:1.37.0-6`	Affected	[CVE-2026-26157]
Opensuseleap 15.6	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Opensuseleap 15.6	busybox-links	`1.37.0-150500.7.11.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Opensuseleap 16.0	busybox	`1.37.0-160000.5.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:20387-1]Mar 26, 2026, 5:23:49 PM UTC
Opensusetumbleweed	busybox	`1.37.0-10.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:10258-1]Mar 23, 2026, 4:54:37 AM UTC
Suselinux enterprise high performance computing 15 sp5-espos	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise high performance computing 15 sp5-ltss	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise module for basesystem 15 sp7	busybox	`1.37.0-150700.18.15.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0759-1]Mar 4, 2026, 10:16:31 PM UTC
Suselinux enterprise server 15 sp5-ltss	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise server 15 sp6-ltss	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise server 16.0	busybox	`1.37.0-160000.5.1`	UnknownSource applicability is not established	[SUSE-SU-2026:20905-1]Apr 2, 2026, 5:33:50 PM UTC
Suselinux enterprise server for sap applications 15 sp5	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise server for sap applications 15 sp6	busybox	`1.37.0-150500.10.17.1`	UnknownSource applicability is not established	[SUSE-SU-2026:0758-1]Mar 4, 2026, 10:16:27 PM UTC
Suselinux enterprise server for sap applications 16.0	busybox	`1.37.0-160000.5.1`	UnknownSource applicability is not established	[SUSE-SU-2026:20905-1]Apr 2, 2026, 5:33:50 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "busybox",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.38.0-3"
    },
    {
      "name": "busybox",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.38.0-3"
    },
    {
      "name": "busybox",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1:1.37.0-6"
    },
    {
      "name": "busybox",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1:1.35.0-4+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1127782,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.37.0-10.1"
    },
    {
      "bug": 1127782,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.37.0-10.1"
    },
    {
      "bug": 1127782,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1127782,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "busybox",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-160000.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:20905-1",
      "fixed_version": "1.37.0-160000.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:20905-1",
      "provider_updated_at": "2026-04-02T17:33:50.352834Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-160000.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:20905-1",
      "fixed_version": "1.37.0-160000.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:20905-1",
      "provider_updated_at": "2026-04-02T17:33:50.352834Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-160000.5.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:20387-1",
      "fixed_version": "1.37.0-160000.5.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:20387-1",
      "provider_updated_at": "2026-03-26T17:23:49.852078Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-10.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:10258-1",
      "fixed_version": "1.37.0-10.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:10258-1",
      "provider_updated_at": "2026-03-23T04:54:37.450496Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150700.18.15.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0759-1",
      "fixed_version": "1.37.0-150700.18.15.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0759-1",
      "provider_updated_at": "2026-03-04T22:16:31.215897Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp5-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp5-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp5-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp6-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.10.17.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.10.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox-links",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.37.0-150500.7.11.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:0758-1",
      "fixed_version": "1.37.0-150500.7.11.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:0758-1",
      "provider_updated_at": "2026-03-04T22:16:27.592237Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1127782]

Publisher notes

[trixie] busybox: Minor issue [bookworm] busybox: Minor issue

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-syslogd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1 · all · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1 · all · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpc]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Interessata
  dsa · busybox · debian · 13
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Interessata
  dsa · busybox · debian · 13
[busybox-syslogd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
[udhcpc]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
[udhcpd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13

[openSUSE Tumbleweed]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Corretta · Corretta: 1.37.0-10.1
  dsa · busybox · opensuse · tumbleweed
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.37.0-10.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed
[busybox-testsuite]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.37.0-10.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed
[busybox-warewulf3]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.37.0-10.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed

Osservato: Oct 24, 2026, 12:53:29 AM UTC

Riferimenti

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]