ZeroDay Findings
Sign inSign up

Findings

CVE-2026-88834

A flaw was found in BusyBox's httpd web server.

Published Oct 13, 2026 · updated Oct 15, 2026

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; de

  2. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; de

Sources

  • CVE.orgVulnerability recordCVE-2026-88834

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-88834

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior.

    nvd.nist.gov

References