Description (CNA)
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Hardened Images | affected |
CWE
CWE-203
References
- https://access.redhat.com/security/cve/CVE-2026-88834
- https://bugzilla.redhat.com/show_bug.cgi?id=2531348
ADP enrichment
No English description supplied.
No references supplied.