SUSE-SU-2026:4798-1

SUSE-SU-2026:4798-1 · Security update for busybox

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages (bsc#1282551). - CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552). - CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568). - CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()` failing to reset the `field_start` cursor between package stanzas (bsc#1282653).

Fix available

Published

2026-10-21T07:55:38Z

Updated

2026-10-21T20:02:15.434809668Z

Stack: system

Check your server →