CVE-2026-88834

LOW 3.7

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CWE	CWE-203
Vendor	red hat
Product	red hat hardened images
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat hardened images

Be the first to know when new low vulnerabilities affecting red hat red hat hardened images are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat Hardened Images

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-88834 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2531348

Credits

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.