CVE-2026-88836: BusyBox BusyBox vulnerability
Published Oct 13, 2026
·Updated
Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATUREWGETHTTPS that it does not verify peer identity or provide full TLS security; missing Finished verifydata checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.
Affected Software
1 affected component
BusyBox BusyBox
Event History
Jan 1, 1970
CVE Published
via MITRE·12:00 AM
Oct 13, 2026
Rejected
via MITRE·03:35 PM
CVE Published
via MITRE·03:40 PM
Rejected
via MITRE·03:40 PM
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
Does this issue require remediation as a security vulnerability?
No. It was rejected because the behavior was determined not to be a security vulnerability; BusyBox's internal TLS implementation intentionally does not provide full TLS security or peer identity verification.
2
Are HTTPS downloads using BusyBox internal TLS protected by normal TLS peer verification?
No. The FEATURE_WGET_HTTPS documentation states that the internal TLS support does not verify peer identity and is intentionally minimal.