CVE-2026-88836

Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Rejected

• CVE-2026-88830A unit confusion in BusyBox TLS Montgomery reduction buffer …7.5
• CVE-2026-88831BusyBox httpd IP deny rules with invalid CIDR prefix lengths…5.3
• CVE-2026-88832BusyBox romfs volume ID parsing uses unbounded strlen on att…7.3
• CVE-2026-88833A flaw was found in BusyBox's udhcpc DHCP client. When proce…6.5
• CVE-2026-88834A flaw was found in BusyBox's httpd web server. When configu…3.7
• CVE-2026-88835BusyBox dpkg read_package_field() steps past a NUL terminato…6.1
• CVE-2026-88837BusyBox httpd treats yescrypt ($y$) password hashes as plain…6.5
• CVE-2026-88838A flaw was found in BusyBox's mount utility. A non-root user…5.5
• CVE-2026-88839BusyBox passwd/group tokenize() references a stale endpoint …6.7
• CVE-2026-8884The Instant-Quote.co Quotation Page plugin for WordPress is …6.4
• CVE-2026-88840BusyBox TLS get_client_hello() reads past the end of the inp…5.3
• CVE-2026-88842A flaw was found in BusyBox dpkg. The write_status_file() fu…3.3