# CVE-2026-16096: Shibby Tomato stack overflow in httpd web monitor log rendering

Source: https://junglewise.ai/threats/cve-2026-16096-shibby-tomato-stack-overflow-in-httpd-web-monitor-log-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16096 · Severity: high · CVSS 8.8 · Published 2026-07-18

A vulnerability exists in the Shibby Tomato firmware, which is used in various network routers. The flaw occurs when the router's web interface processes web monitoring logs, allowing a specially crafted log entry to crash the management service or potentially allow unauthorized actions. This could lead to a loss of router stability or compromise of the device's management functions. Users are advised that this project is legacy and has been superseded by FreshTomato.

Technologies: [Shibby Tomato Shibby](https://junglewise.ai/threats/technologies/tomato-shibby). Vendors: [Shibby](https://junglewise.ai/threats/vendors/shibby).

## Quick answers

**Is CVE-2026-16096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16096 being exploited in the wild.

**How severe is CVE-2026-16096?** High severity, with a CVSS score of 8.8, published 18 July 2026.

**Which products and versions are affected?** Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124.

**Is there a fix for CVE-2026-16096?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16096 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-16096?** Check whether you run Shibby Tomato Shibby. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'httpd' component of Shibby Tomato firmware, specifically within the 'sub_40BB50' function. The vulnerability is caused by the use of 'sscanf' with '%s' format specifiers without field-width limits when parsing entries from '/proc/webmon_recent_domains' and '/proc/webmon_recent_searches'. An attacker can trigger this by ensuring a long domain or search token is recorded in the web monitor logs, which are then processed when an authenticated administrator views the Web Monitor page. While the current evidence primarily supports a Denial of Service (DoS) or data corruption due to stack layout constraints, the overflow can overwrite adjacent local buffers. The Shibby Tomato project is no longer maintained and has been superseded by FreshTomato.

## Affected products

- Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124

## Timeline

- 2026-06-10: disclosed: Initial researcher disclosure on Gitee
- 2026-07-18: advisory: NVD/VulDB publication

## References

- [https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5T](https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5T)
- [https://vuldb.com/cve/CVE-2026-16096](https://vuldb.com/cve/CVE-2026-16096)
- [https://vuldb.com/submit/855124](https://vuldb.com/submit/855124)
- [https://vuldb.com/vuln/379800](https://vuldb.com/vuln/379800)
- [https://vuldb.com/vuln/379800/cti](https://vuldb.com/vuln/379800/cti)

## Related threats

- [Shibby Tomato out-of-bounds write in setup_conntrack](https://junglewise.ai/threats/cve-2026-16095-shibby-tomato-out-of-bounds-write-in-setup-conntrack)
- [Shibby Tomato OS command injection in start_jffs2](https://junglewise.ai/threats/cve-2026-15546-shibby-tomato-os-command-injection-in-start-jffs2)
- [Shibby Tomato out-of-bounds write in apcupsd CGI programs](https://junglewise.ai/threats/cve-2026-15545-shibby-tomato-out-of-bounds-write-in-apcupsd-cgi-programs)