BUSYBOX · CVE-2026-124739 · Infrastructure
NO FIX YET
BusyBox httpd copies the index page name from an 'I:' rule in a subdirectory httpd.conf into a stack buffer with strcpy(). A name that is too long overflows it when that directory is requested. Red Hat says this can crash httpd or possibly run code in the forked child, which runs as root unless httpd is started with -u. No upstream fix or affected version range is published yet.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only systems that run BusyBox httpd (the small web server built into BusyBox, common on routers, embedded devices and containers) are exposed. The attacker must be able to write an httpd.conf file in a directory served by httpd (Red Hat rates it Important for local users with write access to the web root). Systems where httpd is not used, or where only administrators can write to the web root, can skip it. Affected versions are not yet published.
Not affected if httpd-not-used, httpd-run-with-u-option, web-root-admin-only
Who cares busybox, embedded, httpd, linux, root-privileges
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.