[CVE-2026-92205 ] Published: Oct 21, 2026, 5:17:22 PM UTC
busybox: CVE-2026-92205
Medium(6.1) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
dsa · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
[CVE-2026-88829 ] Published: Oct 14, 2026, 8:00:00 AM UTC
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection h
High(7.2) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
[CVE-2026-90954 ] Published: Oct 14, 2026, 8:00:00 AM UTC
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after t
High(7.8) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
[CVE-2026-88838 ] Published: Oct 13, 2026, 1:50:19 PM UTC
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the no
Medium(5.5) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
[CVE-2026-88834 ] Published: Oct 13, 2026, 1:49:55 PM UTC
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish ex
Low(3.7) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
[CVE-2026-88833 ] Published: Oct 13, 2026, 1:49:21 PM UTC
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-vali
Medium(6.5) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm; pypi · busybox · debian · 12; pypi · busybox · debian · 13; pypi · busybox · debian · 14
[CVE-2026-88842 ] Published: Oct 12, 2026, 5:14:28 PM UTC
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is l
Low(3.3) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
[CVE-2026-108119 ] Published: Oct 9, 2026, 3:31:42 PM UTC
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains insid
Medium(6.3) Sconosciuto Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Sconosciuto
Version impact unknown
nvd · busybox · debian · bookworm
[CVE-2026-88830 ] Published: Sep 23, 2026, 4:35:00 PM UTC
A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.
High(8.1) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 11:06:19 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88831 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
Medium(5.3) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88832 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.
High(7.8) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88835 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
Medium(6.1) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88837 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
Medium(6.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88839 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
Medium(6.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-88840 ] Published: Sep 23, 2026, 4:35:00 PM UTC
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
Medium(5.3) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 8:36:00 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1 · all · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Non interessata
nvd · busybox · debian · bookworm
[CVE-2026-88841 ] Published: Sep 23, 2026, 4:35:00 PM UTC
busybox: CVE-2026-88841
Medium(4.4) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 7:48:10 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[CVE-2026-76014 ] Published: Aug 18, 2026, 10:00:00 PM UTC
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the ar
Medium(5.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:38:43 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-38752 ] Published: Jul 15, 2026, 12:00:00 AM UTC
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Medium(6.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:44:14 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-38753 ] Published: Jul 15, 2026, 12:00:00 AM UTC
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
High(7.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:44:15 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
[CVE-2026-38754 ] Published: Jul 15, 2026, 12:00:00 AM UTC
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
High(7.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:44:14 PM UTC
Dettagli (10) 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1 · all · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
Interessata
nvd · busybox · debian · bookworm; nvd · busybox · debian · 12
