CVE Feed

    Dashboard / CVE / CVE-2026-88834

    CVE-2026-88834

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

    Published:Oct 13, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 13, 2026
    EPSS Score:
    CVSS Score:3.7

    Affected Products

    Vendor
    Busybox
    Product
    Busybox
    Vendor
    Redhat
    Product
    Hummingbird

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-203 Observable Discrepancy

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-189 Black Box Reverse Engineering

    Related CVEs

    CVE-2026-92205 (CVSS 6.1) — BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allow…
    CVE-2026-90954 (CVSS 7.8) — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks af…
    CVE-2026-88829 (CVSS 7.2) — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests ma…
    CVE-2026-88838 (CVSS 5.5) — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /et…
    CVE-2026-88833 (CVSS 6.5) — A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the va…
    CVE-2026-108119 (CVSS 6.3) — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries…
    CVE-2026-88830 (CVSS 7.5) — A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer…
    CVE-2026-88837 (CVSS 6.5) — BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the au…
    CVE-2026-88835 (CVSS 6.1) — BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bo…
    CVE-2026-88839 (CVSS 6.7) — BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds w…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High