Executive brief
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
Junglewise Threat Intelligence
CVE-2026-88831: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no client
CVE-2026-88831 · Severity: medium · CVSS 5.3 · Published 2026-09-23