Skip to content
OpenAdvisories
High WID-SEC-2026-3953 3 CVEs

BusyBox: Mehrere Schwachstellen

Published Oct 14, 2026 · Updated Oct 14, 2026 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

BusyBox ist ein Computerprogramm, das verschiedene Standard-Unix-Dienstprogramme in einem einzelnen Programm vereint.

Vulnerabilities 3

  • High 7.8
    CVE-2026-90954

    Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

    A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two d…

    Red Hat Red Hat Hardened Images busybox busybox Debian Ubuntu Azure Linux
  • High 7.2
    CVE-2026-88829

    Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

    A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined sec…

    Red Hat Red Hat Hardened Images busybox busybox Debian Ubuntu Azure Linux
  • Low 3.3
    CVE-2026-88842

    Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dro…

    Red Hat Red Hat Hardened Images busybox busybox Debian Ubuntu Azure Linux

Revision history

  1. #1

    Initiale Fassung

References