# CVE-2026-88836: BusyBox TLS missing Finished verify_data checking

Source: https://junglewise.ai/threats/cve-2026-88836-rejected-reason-red-hat-product-security-determined-this-is-not-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-88836 · Severity: info · Published 2026-10-13

BusyBox is a lightweight utility suite commonly embedded in routers, IoT devices, and embedded systems. The internal TLS implementation used by BusyBox's wget HTTPS feature is intentionally minimal and does not verify peer identity or provide full TLS security. Red Hat Product Security determined that missing Finished message verify_data checking is consistent with the documented design limitations and does not constitute a separate security vulnerability.</brief>
<parameter name="severity">info

Technologies: [BusyBox](https://junglewise.ai/threats/technologies/x-busybox).

## Quick answers

**Is CVE-2026-88836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88836 being exploited in the wild.

**How severe is CVE-2026-88836?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** BusyBox <UNKNOWN>.

**Is there a fix for CVE-2026-88836?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88836 attacked?** It is in a software library.

**Am I affected by CVE-2026-88836?** Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

BusyBox's FEATURE_WGET_HTTPS implements a minimal TLS stack that intentionally skips peer identity verification and other full TLS security measures. The missing Finished message verify_data checking in the TLS handshake completion is a design choice documented in the feature documentation, not a defect crossing a separate security boundary. Red Hat Product Security assessed this as a design limitation rather than a security vulnerability.

## Affected products

- BusyBox <UNKNOWN>

## Timeline

- 2026-10-13: disclosed

## Related threats

- [BusyBox integer overflow in volume_id](https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the)
- [BusyBox tar hardlink resolution path traversal](https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar)
- [BusyBox cpio hardlink path traversal vulnerability](https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio)
- [BusyBox divide-by-zero in HFS+ filesystem parsing](https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata)
- [BusyBox udhcpc6 use-after-free in DHCPv6 client](https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious)