Veille CVE

Mercredi 23 septembre 2026

7 CVE

Critique 0 Élevée 2 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « BusyBox » ✕
  1. CVE-2026-88840 5.3 Moyenne

    Red Hat Hardened Images

    BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

  2. CVE-2026-88839 6.7 Moyenne

    Red Hat Hardened Images

    BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

  3. CVE-2026-88837 6.5 Moyenne

    Red Hat Hardened Images

    BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

  4. CVE-2026-88835 6.1 Moyenne

    Red Hat Hardened Images

    BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

  5. CVE-2026-88831 5.3 Moyenne

    Red Hat Hardened Images

    BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

  6. CVE-2026-88832 7.3 Élevée

    Red Hat Hardened Images

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

  7. CVE-2026-88830 7.5 Élevée

    Red Hat Hardened Images

    A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.