Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-88831

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

Description

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Hardened Images

Default version status: affected

  • 1.37.0-9.1.hum1 to < *unaffected

References