CVE-2026-124739: Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
Other sources
A flaw was found in BusyBox's httpd. handleincomingandexit() allocates a stack copy of the request URL sized for the current index page name, then parses the httpd.conf file of each directory on the requested path, and finally copies the index page name into that buffer with strcpy(). Because parseconf() honors an "I:" index-page rule in subdirectory httpd.conf files, an overly long index page name in such a file overflows the stack buffer with attacker-chosen bytes when the directory is requested. A user who can write a subdirectory httpd.conf can use this to crash httpd or potentially execute arbitrary code in the forked child process, which runs as root unless the -u option is used.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
BusyBox deployments running the httpd web server are exposed if untrusted or lower-privileged users can write a subdirectory httpd.conf file. The affected path is reached when a request targets the directory containing that configuration file.
What does an attacker need to exploit it?
An attacker needs permission to write a subdirectory httpd.conf and must set an overly long value using an I: index-page rule. They then need the corresponding directory to be requested so httpd processes that configuration.
Does the impact depend on how httpd is started?
Yes. The vulnerable request handling occurs in a forked child process that runs as root unless httpd is started with the -u option. Running with -u reduces the privilege level available to potential code execution, though it does not prevent a crash.
How can I determine whether my deployment is at risk?
Review directories served by BusyBox httpd for per-directory httpd.conf files, especially ones writable by non-administrative users. Check those files for I: rules with unusually long index-page names and verify whether the affected directories can be requested.