{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nbusybox:\n  * busybox-1.37.0-9.1.hum1 (aarch64, x86_64)\n  * busybox-petitboot-1.37.0-9.1.hum1 (aarch64, x86_64)\n  * busybox-shared-1.37.0-9.1.hum1 (aarch64, x86_64)\n  * busybox-1.37.0-9.1.hum1.src (src)\n\nSecurity Fix(es):\n\nbusybox:\n  * CVE-2026-88832\n  * CVE-2026-88831\n  * CVE-2026-88837\n  * CVE-2026-88835\n  * CVE-2026-88839",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:72111",
        "url": "https://access.redhat.com/errata/RHSA-2026:72111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88831",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88831"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88832",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88832"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88835",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88835"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88837",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88837"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88839",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88839"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72111.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-25T22:28:13+00:00",
      "generator": {
        "date": "2026-09-25T22:28:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:72111",
      "initial_release_date": "2026-09-25T19:35:52+00:00",
      "revision_history": [
        {
          "date": "2026-09-25T19:35:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-25T19:37:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-25T22:28:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-0:1.37.0-9.1.hum1@aarch64",
                "product": {
                  "name": "busybox-0:1.37.0-9.1.hum1@aarch64",
                  "product_id": "busybox-0:1.37.0-9.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
                "product": {
                  "name": "busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
                  "product_id": "busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-petitboot@1.37.0-9.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-shared-0:1.37.0-9.1.hum1@aarch64",
                "product": {
                  "name": "busybox-shared-0:1.37.0-9.1.hum1@aarch64",
                  "product_id": "busybox-shared-0:1.37.0-9.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-shared@1.37.0-9.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-0:1.37.0-9.1.hum1@src",
                "product": {
                  "name": "busybox-0:1.37.0-9.1.hum1@src",
                  "product_id": "busybox-0:1.37.0-9.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "busybox-0:1.37.0-9.1.hum1@x86_64",
                "product": {
                  "name": "busybox-0:1.37.0-9.1.hum1@x86_64",
                  "product_id": "busybox-0:1.37.0-9.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox@1.37.0-9.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
                "product": {
                  "name": "busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
                  "product_id": "busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-petitboot@1.37.0-9.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "busybox-shared-0:1.37.0-9.1.hum1@x86_64",
                "product": {
                  "name": "busybox-shared-0:1.37.0-9.1.hum1@x86_64",
                  "product_id": "busybox-shared-0:1.37.0-9.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/busybox-shared@1.37.0-9.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64"
        },
        "product_reference": "busybox-0:1.37.0-9.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-0:1.37.0-9.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src"
        },
        "product_reference": "busybox-0:1.37.0-9.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64"
        },
        "product_reference": "busybox-0:1.37.0-9.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-petitboot-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64"
        },
        "product_reference": "busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-petitboot-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64"
        },
        "product_reference": "busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-shared-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64"
        },
        "product_reference": "busybox-shared-0:1.37.0-9.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "busybox-shared-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        },
        "product_reference": "busybox-shared-0:1.37.0-9.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88831",
      "cwe": {
        "id": "CWE-636",
        "name": "Not Failing Securely (\u0027Failing Open\u0027)"
      },
      "discovery_date": "2026-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531346"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw causes BusyBox httpd to silently ignore malformed IP deny rules, allowing network clients that should be blocked to access protected content. BusyBox httpd is rarely deployed as a production web server on Fedora, and exploitation requires a misconfigured CIDR mask in the httpd configuration file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531346",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531346"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88831"
        }
      ],
      "release_date": "2026-09-23T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-25T19:35:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72111"
        },
        {
          "category": "workaround",
          "details": "Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls (iptables/nftables) as the primary enforcement layer rather than relying on application-level ACLs.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88832",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows an attacker with local access to cause a heap buffer overflow when a user processes a crafted romfs filesystem image with BusyBox blkid or findfs, potentially leading to code execution. On Fedora, neither blkid nor findfs is installed setuid, and exploitation requires that a local user actively process a malicious filesystem image.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88832"
        }
      ],
      "release_date": "2026-09-23T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-25T19:35:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72111"
        },
        {
          "category": "workaround",
          "details": "Avoid processing untrusted filesystem images with BusyBox blkid or findfs. Use the util-linux versions of these utilities instead (default on Fedora).",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88835",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531349"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a crafted .deb package to crash the BusyBox dpkg applet or potentially leak adjacent heap memory. Fedora uses RPM as its package management format, and the BusyBox dpkg applet has no practical deployment scenario on Fedora systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88835"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531349",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88835",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88835"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88835"
        }
      ],
      "release_date": "2026-09-23T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-25T19:35:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72111"
        },
        {
          "category": "workaround",
          "details": "Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88837",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531351"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fedora 44 uses yescrypt ($y$) as the default password hashing algorithm, so any Fedora system administrator who configures BusyBox httpd with inline password hashes will produce vulnerable configurations by default. However, BusyBox httpd is not used as a web server on Fedora in any standard deployment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88837"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531351",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531351"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88837",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88837"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88837"
        }
      ],
      "release_date": "2026-09-23T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-25T19:35:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72111"
        },
        {
          "category": "workaround",
          "details": "Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 ($6$) hashes, which are correctly detected. Upstream should update the hash detection logic to recognize the $y$ prefix.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shubham Raj"
          ],
          "organization": "Causal Security"
        }
      ],
      "cve": "CVE-2026-88839",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531353"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "On Fedora 44, /etc/group is owned by root:root with mode 0644 and protected by SELinux. Only root can modify this file. Since root privileges are required to inject the malformed entry, the vulnerability adds no practical value on Fedora, as an attacker with root access already has full system control.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
          "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
          "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88839"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531353",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531353"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88839"
        }
      ],
      "release_date": "2026-09-23T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-25T19:35:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72111"
        },
        {
          "category": "workaround",
          "details": "Ensure /etc/group and /etc/passwd are writable only by root and protected by mandatory access controls. Monitor these files for unauthorized modifications. Upstream should fix tokenize() to recompute tokenize_end after trimming.",
          "product_ids": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@src",
            "Red Hat Hardened Images:busybox-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-petitboot-0:1.37.0-9.1.hum1@x86_64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@aarch64",
            "Red Hat Hardened Images:busybox-shared-0:1.37.0-9.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint"
    }
  ]
}