CVE-2026-88831

MediumCVSS 5.3/10Last modified Sep 25, 2026

Description

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-636

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-888327.3BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafteCVE-2026-888336.5A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an CVE-2026-888343.7A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in ceCVE-2026-888356.1BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.CVE-2026-888376.5BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.CVE-2026-888385.5A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearingCVE-2026-888396.7BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.CVE-2026-88846.4The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versioCVE-2026-888405.3BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.CVE-2026-888423.3A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages CVE-2026-888437.2The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to CVE-2026-888442.7The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returni
CVE-2026-88831: Medium severity, CVSS 5.3 | Vulnix