{"schema_version":1,"title":"BusyBox vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in BusyBox: 8 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124746, was published on 11 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1).","url":"https://junglewise.ai/threats/technologies/x-busybox","json_url":"https://junglewise.ai/threats/technologies/x-busybox.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/x-busybox","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":12,"critical":0,"exploited":0,"last_7_days":8,"last_30_days":9,"last_90_days":12,"last_365_days":12},"latest":[{"cve":"CVE-2026-124746","cvss":5.5,"slug":"cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the","title":"BusyBox integer overflow in volume_id","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:19.57+00:00","url":"https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the"},{"cve":"CVE-2026-124745","cvss":6.3,"slug":"cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar","title":"BusyBox tar hardlink resolution path traversal","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:20.043+00:00","url":"https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar"},{"cve":"CVE-2026-124744","cvss":6.3,"slug":"cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio","title":"BusyBox cpio hardlink path traversal vulnerability","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:19.883+00:00","url":"https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio"},{"cve":"CVE-2026-124743","cvss":5.5,"slug":"cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata","title":"BusyBox divide-by-zero in HFS+ filesystem parsing","severity":"medium","exploited":false,"published_at":"2026-11-11T12:19:48.027+00:00","url":"https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata"},{"cve":"CVE-2026-124740","cvss":4.3,"slug":"cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious","title":"BusyBox udhcpc6 use-after-free in DHCPv6 client","severity":"medium","exploited":false,"published_at":"2026-11-11T12:19:47.71+00:00","url":"https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious"},{"cve":"CVE-2026-124738","cvss":5.3,"slug":"cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre","title":"BusyBox httpd authentication bypass via pre-compressed files","severity":"medium","exploited":false,"published_at":"2026-11-11T12:19:47.537+00:00","url":"https://junglewise.ai/threats/cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre"},{"cve":"CVE-2026-124741","cvss":7.6,"slug":"cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not","title":"BusyBox udhcpc6 stack buffer overflow in DHCPv6 options","severity":"high","exploited":false,"published_at":"2026-11-11T11:17:17.233+00:00","url":"https://junglewise.ai/threats/cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not"},{"cve":"CVE-2026-124747","cvss":7.5,"slug":"cve-2026-124747-a-flaw-was-found-in-busybox-when-resuming-a-download-over-file","title":"BusyBox wget heap buffer overflow in FTP resume","severity":"high","exploited":false,"published_at":"2026-11-10T13:18:22.343+00:00","url":"https://junglewise.ai/threats/cve-2026-124747-a-flaw-was-found-in-busybox-when-resuming-a-download-over-file"},{"cve":"CVE-2026-90954","cvss":7.8,"epss":0.002,"slug":"cve-2026-90954-a-flaw-was-found-in-busybox-s-dpkg-deb-archive-extraction-the-ar","title":"BusyBox dpkg-deb path traversal in archive extraction","severity":"high","exploited":false,"published_at":"2026-10-14T10:17:57.297+00:00","url":"https://junglewise.ai/threats/cve-2026-90954-a-flaw-was-found-in-busybox-s-dpkg-deb-archive-extraction-the-ar"},{"cve":"CVE-2026-88838","cvss":5.5,"epss":0.0011,"slug":"cve-2026-88838-a-flaw-was-found-in-busybox-s-mount-utility-a-non-root-user-can","title":"BusyBox mount security restriction bypass in mount utility","severity":"medium","exploited":false,"published_at":"2026-10-13T17:17:48.34+00:00","url":"https://junglewise.ai/threats/cve-2026-88838-a-flaw-was-found-in-busybox-s-mount-utility-a-non-root-user-can"},{"cve":"CVE-2026-88836","slug":"cve-2026-88836-rejected-reason-red-hat-product-security-determined-this-is-not-a","title":"BusyBox TLS missing Finished verify_data checking","severity":"info","exploited":false,"published_at":"2026-10-13T16:17:23.96+00:00","url":"https://junglewise.ai/threats/cve-2026-88836-rejected-reason-red-hat-product-security-determined-this-is-not-a"},{"cve":"CVE-2026-108119","cvss":6.3,"epss":0.0014,"slug":"cve-2026-108119-a-flaw-was-found-in-busybox-the-tar-applet-s-deferred-link","title":"BusyBox tar applet path traversal in deferred link creation","severity":"medium","exploited":false,"published_at":"2026-10-09T17:16:46.4+00:00","url":"https://junglewise.ai/threats/cve-2026-108119-a-flaw-was-found-in-busybox-the-tar-applet-s-deferred-link"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":8}],"related":[],"technology":{"hub":true,"name":"BusyBox","slug":"x-busybox","aliases":[],"category":"utility-suite","description":"Lightweight multi-call binary providing core Unix utilities and shell functionality.","url":"https://junglewise.ai/threats/technologies/x-busybox"},"most_severe":[{"cve":"CVE-2026-90954","cvss":7.8,"epss":0.002,"slug":"cve-2026-90954-a-flaw-was-found-in-busybox-s-dpkg-deb-archive-extraction-the-ar","title":"BusyBox dpkg-deb path traversal in archive extraction","severity":"high","exploited":false,"published_at":"2026-10-14T10:17:57.297+00:00","url":"https://junglewise.ai/threats/cve-2026-90954-a-flaw-was-found-in-busybox-s-dpkg-deb-archive-extraction-the-ar"},{"cve":"CVE-2026-124741","cvss":7.6,"slug":"cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not","title":"BusyBox udhcpc6 stack buffer overflow in DHCPv6 options","severity":"high","exploited":false,"published_at":"2026-11-11T11:17:17.233+00:00","url":"https://junglewise.ai/threats/cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not"},{"cve":"CVE-2026-124747","cvss":7.5,"slug":"cve-2026-124747-a-flaw-was-found-in-busybox-when-resuming-a-download-over-file","title":"BusyBox wget heap buffer overflow in FTP resume","severity":"high","exploited":false,"published_at":"2026-11-10T13:18:22.343+00:00","url":"https://junglewise.ai/threats/cve-2026-124747-a-flaw-was-found-in-busybox-when-resuming-a-download-over-file"},{"cve":"CVE-2026-108119","cvss":6.3,"epss":0.0014,"slug":"cve-2026-108119-a-flaw-was-found-in-busybox-the-tar-applet-s-deferred-link","title":"BusyBox tar applet path traversal in deferred link creation","severity":"medium","exploited":false,"published_at":"2026-10-09T17:16:46.4+00:00","url":"https://junglewise.ai/threats/cve-2026-108119-a-flaw-was-found-in-busybox-the-tar-applet-s-deferred-link"},{"cve":"CVE-2026-124745","cvss":6.3,"slug":"cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar","title":"BusyBox tar hardlink resolution path traversal","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:20.043+00:00","url":"https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar"},{"cve":"CVE-2026-124744","cvss":6.3,"slug":"cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio","title":"BusyBox cpio hardlink path traversal vulnerability","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:19.883+00:00","url":"https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio"},{"cve":"CVE-2026-88838","cvss":5.5,"epss":0.0011,"slug":"cve-2026-88838-a-flaw-was-found-in-busybox-s-mount-utility-a-non-root-user-can","title":"BusyBox mount security restriction bypass in mount utility","severity":"medium","exploited":false,"published_at":"2026-10-13T17:17:48.34+00:00","url":"https://junglewise.ai/threats/cve-2026-88838-a-flaw-was-found-in-busybox-s-mount-utility-a-non-root-user-can"},{"cve":"CVE-2026-124746","cvss":5.5,"slug":"cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the","title":"BusyBox integer overflow in volume_id","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:19.57+00:00","url":"https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the"},{"cve":"CVE-2026-124743","cvss":5.5,"slug":"cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata","title":"BusyBox divide-by-zero in HFS+ filesystem parsing","severity":"medium","exploited":false,"published_at":"2026-11-11T12:19:48.027+00:00","url":"https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata"},{"cve":"CVE-2026-124738","cvss":5.3,"slug":"cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre","title":"BusyBox httpd authentication bypass via pre-compressed files","severity":"medium","exploited":false,"published_at":"2026-11-11T12:19:47.537+00:00","url":"https://junglewise.ai/threats/cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}