Is CVE-2025-60876 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60876 being exploited in the wild.

How severe is CVE-2025-60876?

Medium severity, with a CVSS score of 6.5, published 10 November 2025.

Which products and versions are affected?

Busybox up to and including 1.37.0.

Is there a fix for CVE-2025-60876?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60876 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-60876?

Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60876: BusyBox wget HTTP header injection via request-target splitting

CVE-2025-60876 · Severity: medium · CVSS 6.5 · Published 2025-11-10

BusyBox, a widely used suite of software tools for embedded systems, contains a vulnerability in its 'wget' utility. An attacker can provide a specially crafted web address (URL) that tricks the tool into sending unauthorized commands or headers to a web server. This could allow an attacker to bypass security checks, poison web caches, or access restricted data.

Technologies: Busybox. Vendors: Busybox.

Quick answers

Is CVE-2025-60876 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60876 being exploited in the wild.
How severe is CVE-2025-60876?: Medium severity, with a CVSS score of 6.5, published 10 November 2025.
Which products and versions are affected?: Busybox up to and including 1.37.0.
Is there a fix for CVE-2025-60876?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60876 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-60876?: Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

BusyBox wget through version 1.37.0 fails to sanitize raw CR (0x0D), LF (0x0A), and other C0 control bytes, as well as raw spaces (0x20), in the HTTP request-target (path/query). An attacker who can influence the URL passed to wget—either directly or via a redirect—can inject CRLF sequences to split the HTTP request line. This allows for the injection of arbitrary HTTP headers (such as Authorization or X-Forwarded-For), which can lead to cache poisoning, security policy bypasses, or credential exposure. The vulnerability is addressed by rejecting control characters and raw spaces in the request-target, requiring clients to use proper percent-encoding.

Affected products

BusyBox BusyBox up to and including 1.37.0

Timeline

2025-08-23: disclosed: Initial report to BusyBox mailing list
2025-11-10: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.