# CVE-2026-124739: BusyBox httpd stack buffer overflow in subdirectory config

Source: https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-124739 · Severity: high · CVSS 7.5 · Published 2026-11-11

BusyBox is a lightweight utility suite often embedded in network devices and IoT systems, including its built-in httpd web server. When processing configuration files in subdirectories, an attacker with write access can craft an overly long index page name to cause a stack overflow, leading to arbitrary code execution with root privileges or a crash of the web server. This vulnerability allows local escalation of privilege if the service runs with elevated permissions.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox).

## Quick answers

**Is CVE-2026-124739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124739 being exploited in the wild.

**How severe is CVE-2026-124739?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** BusyBox BusyBox.

**Is there a fix for CVE-2026-124739?** No fixed version is recorded yet. Restrict write permissions on web root and subdirectory paths to administrative accounts only (chmod -R o-w /path/to/webroot). Ensure BusyBox httpd runs as an unprivileged user by using the `-u` flag (e.g., `busybox httpd -u nobody`) and restart the service for the change to take effect. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124739 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-124739?** Check whether you run Busybox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict write permissions on web root and subdirectory paths to administrative accounts only (chmod -R o-w /path/to/webroot). Ensure BusyBox httpd runs as an unprivileged user by using the `-u` flag (e.g., `busybox httpd -u nobody`) and restart the service for the change to take effect.

## Technical details

A stack-based buffer overflow (CWE-787) exists in BusyBox httpd when parsing the "I:" rule in subdirectory httpd.conf configuration files with an overly long index page name. The vulnerability requires network access to a running httpd service and low privileges (local write access to a web-accessible directory or its configuration files), with no user interaction needed. Exploitation allows arbitrary code execution with the service's privilege level or denial of service via process crash.

## Affected products

- BusyBox BusyBox

## Timeline

- 2026-11-11: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-124739](https://access.redhat.com/security/cve/CVE-2026-124739)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox libarchive symlink directory traversal arbitrary file creation](https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)
- [BusyBox TLS out-of-bounds read in ClientHello parsing](https://junglewise.ai/threats/cve-2026-88840-busybox-tls-get-client-hello-reads-past-the-end-of-the-input)