RHSA-2026:72111HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 25, 2026
Last Modified
September 25, 2026

🔗 CVE IDs covered (5)

CVE-2026-88831 →CVE-2026-88832 →CVE-2026-88835 →CVE-2026-88837 →CVE-2026-88839 →

📋 Description

CVE-2026-88831 — busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths CVE-2026-88832 — busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow CVE-2026-88835 — busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages CVE-2026-88837 — busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication CVE-2026-88839 — busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

🎯 Affected products8

  • Red Hat Hardened Images
  • busybox-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-0:1.37.0-9.1.hum1@src as a component of Red Hat Hardened Images
  • busybox-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • busybox-petitboot-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-petitboot-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • busybox-shared-0:1.37.0-9.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-shared-0:1.37.0-9.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls (iptables/nftables) as the primary enforcement layer rather than relying on application-level ACLs. Workaround: Avoid processing untrusted filesystem images with BusyBox blkid or findfs. Use the util-linux versions of these utilities instead (default on Fedora). Workaround: Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed. Workaround: Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 ($6$) hashes, which are correctly detected. Upstream should update the hash detection logic to recognize the $y$ prefix. Workaround: Ensure /etc/group and /etc/passwd are writable only by root and protected by mandatory access controls. Monitor these files for unauthorized modifications. Upstream should fix tokenize() to recompute tokenize_end after trimming.

🔗 References (9)