---
id: "CVE-2026-124739"
page: "https://infrastack.ai/live/CVE-2026-124739"
kind: "vulnerability"
aliases: ["CVE-2026-124739"]
title: "BusyBox httpd: long index page name overflows stack, enabling code execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "busybox", "fixed": [], "affected": "unknown (not published)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["busybox", "embedded", "httpd", "infrastructure", "linux", "root-privileges"]
not_affected_if: ["httpd-not-used", "httpd-run-with-u-option", "web-root-admin-only"]
published_at: "2026-11-11T11:17:16+00:00"
first_seen_at: "2026-11-11T11:26:56+00:00"
updated_at: "2026-11-11T11:28:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124739", "first_seen_at": "2026-11-11T11:26:56+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-124739", "first_seen_at": "2026-11-11T11:28:18+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-124739", "https://bugzilla.redhat.com/show_bug.cgi?id=2571613"]}]
exploit_sources: []
---

# BusyBox httpd: long index page name overflows stack, enabling code execution

Link for people: https://infrastack.ai/live/CVE-2026-124739 (this .md is for agents)

BusyBox httpd copies the index page name from an 'I:' rule in a subdirectory httpd.conf into a stack buffer with strcpy(). A name that is too long overflows it when that directory is requested. Red Hat says this can crash httpd or possibly run code in the forked child, which runs as root unless httpd is started with -u. No upstream fix or affected version range is published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:busybox affected unknown (not published) fixed no fixed version listed

## How to check

- Run 'busybox httpd --help' (or check for a running 'busybox httpd' / 'httpd' process) to see whether BusyBox httpd is in use.
- Look for httpd.conf files in subdirectories of the web root that contain an 'I:' line, and check who can write them.
- Check whether httpd was started with -u <user>; without it the child runs as root.
- Affected and fixed versions: unknown. Red Hat lists none and no upstream commit is linked yet. Watch the Red Hat page and busybox.net.

## Timeline

- 2026-11-11T11:26:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124739
- 2026-11-11T11:28:18+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-124739 — Red Hat CVE page + Bugzilla 2571613 give the mechanism (I: rule in subdirectory httpd.conf, strcpy into stack buffer in handle_incoming_and_exit, child runs as root unless -u). No affected/fixed BusyBox versions or upstream commit published yet; NVD page is empty. Latest release 1.38.0 (May 2026); unconfirmed whether it is affected.

## Documents

- [advisory] Red Hat CVE-2026-124739 https://access.redhat.com/security/cve/CVE-2026-124739
- [describes] Red Hat Bugzilla 2571613: httpd stack buffer overflow via I: rule https://bugzilla.redhat.com/show_bug.cgi?id=2571613

## From the sources

A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_