CVE-2026-88831: Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.
This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.
Other sources
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BusyBox httpd deployments are exposed when they use IP-based D: deny ACL rules containing an invalid CIDR prefix length. A deployment without such a malformed deny rule is not described as affected by this issue.
What would an attacker need to exploit it?
An attacker needs network access to the BusyBox httpd service from an address that administrators intended to block with the malformed deny rule. No privileges or user interaction are required according to the provided vector.
How can I determine whether my configuration is affected?
Review BusyBox httpd IP deny ACL entries for D: rules with syntactically invalid CIDR prefix lengths, such as /999. Such rules can parse into an address with a zeroed mask and match no clients.
What can be done before a patch is available?
Correct or remove deny rules with invalid CIDR prefix lengths and use valid CIDR values for the intended blocked ranges. Verify that the resulting rules actually deny traffic from addresses in those ranges.