ZeroDay Findings
Sign inSign up

Findings

SUSE-SU-2026:24137-1

Security update for busybox

Published Oct 10, 2026 · updated Oct 15, 2026

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551). - CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552). - CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568). - CVE-2026-88841: OOB read and silent memory corruption of the status file due to failing to reset the cursor between package stanzas (bsc#1282653).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 10, 2026 · OSV.dev

    Detected

    This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded

  2. Oct 15, 2026 · OSV.dev

    Fix available

    busybox fixed in 1.36.1-159998.1.1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    busybox fixed in 1.36.1-159998.1.1

  4. Oct 15, 2026 · OSV.dev

    Updated

    This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded

Affected

  • SUSE:Linux Micro 6.0 busybox0 → 1.36.1-159998.1.1

Sources

  • OSV.devPackage advisorySUSE-SU-2026:24137-1

    Security update for busybox

    osv.dev

References

SUSE-SU-2026:24137-1 · ZeroDay Findings