LOW 3.7 NVD
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configur
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
References
- https://access.redhat.com/security/cve/CVE-2026-88834
- https://bugzilla.redhat.com/show_bug.cgi?id=2531348
This low severity vulnerability with a CVSS score of 3.7 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.