BusyBox httpd: Stack-based buffer overflow in subdirectory configuration handling
Summary
BusyBox httpd, the small web server applet of BusyBox, has a stack-based buffer overflow (CWE-787). It is triggered when the server processes subdirectory configuration files that contain an overly long index page name. An attacker who can write to such a configuration file could execute arbitrary code with elevated privileges or crash the server process. Red Hat rates the issue Important; the prerequisite of write access to served directories limits the risk to systems that run BusyBox httpd.
Affected
- Red Hat Enterprise Linux 6 (busybox), per Red Hat CVE record
- Red Hat Hardened Images (busybox), per Red Hat CVE record
- Other BusyBox versions and distributions: Unknown.
Fixed in
Unknown. No Red Hat errata or upstream BusyBox fix was found for this CVE at the time of writing.
Workaround
- Restrict write permissions on the web root and all subdirectories served by httpd to administrative accounts only (chmod -R o-w /path/to/webroot).
- Run httpd as an unprivileged user with the -u option (for example busybox httpd -u nobody). A restart is required.
- Stop or remove BusyBox httpd where it is not needed.
Exploitation
- No public exploit known.
- Not known to be exploited in the wild.
- Not listed in CISA KEV as far as verified.
Our recommendation
- Check whether any device, appliance or container in your environment runs BusyBox httpd.
- Restrict write access to web and subdirectories now and apply the vendor fix once it is confirmed.
- Monitor the NVD analysis and the Red Hat advisory, because the scores differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-124739 access.redhat.com
- Red Hat Bugzilla 2571613 bugzilla.redhat.com
- VulDB entry 435738 vuldb.com
- OffSeq Radar mirror of Red Hat record radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:24.
Original description (NVD)
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.