# CVE-2025-60876: BusyBox wget HTTP header injection via request-target splitting

Source: https://junglewise.ai/threats/cve-2025-60876-busybox-wget-http-header-injection-via-request-target-splitting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-10. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2025-60876 · Severity: medium · CVSS 6.5 · Published 2025-11-10

BusyBox, a widely used suite of software tools for embedded systems, contains a vulnerability in its 'wget' utility. An attacker can provide a specially crafted web address (URL) that tricks the tool into sending unauthorized commands or headers to a web server. This could allow an attacker to bypass security checks, poison web caches, or access restricted data.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox).

## Quick answers

**Is CVE-2025-60876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60876 being exploited in the wild.

**How severe is CVE-2025-60876?** Medium severity, with a CVSS score of 6.5, published 10 November 2025.

**Which products and versions are affected?** Busybox up to and including 1.37.0.

**Is there a fix for CVE-2025-60876?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60876 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-60876?** Check whether you run Busybox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

BusyBox wget through version 1.37.0 fails to sanitize raw CR (0x0D), LF (0x0A), and other C0 control bytes, as well as raw spaces (0x20), in the HTTP request-target (path/query). An attacker who can influence the URL passed to wget—either directly or via a redirect—can inject CRLF sequences to split the HTTP request line. This allows for the injection of arbitrary HTTP headers (such as Authorization or X-Forwarded-For), which can lead to cache poisoning, security policy bypasses, or credential exposure. The vulnerability is addressed by rejecting control characters and raw spaces in the request-target, requiring clients to use proper percent-encoding.

## Affected products

- BusyBox BusyBox up to and including 1.37.0

## Timeline

- 2025-08-23: disclosed: Initial report to BusyBox mailing list
- 2025-11-10: advisory: CVE published

## References

- [https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092](https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092)
- [https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm](https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm)
- [https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm](https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox httpd stack buffer overflow in subdirectory config](https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox libarchive symlink directory traversal arbitrary file creation](https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)