CVE-2026-88836: Busybox Busybox vulnerability

Published Oct 13, 2026

Updated

Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATUREWGETHTTPS that it does not verify peer identity or provide full TLS security; missing Finished verifydata checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

Affected Software

1 affected component

Busybox Busybox

Event History

Jan 1, 1970

CVE Published

via MITRE·12:00 AM

Oct 13, 2026

Rejected

via MITRE·03:35 PM

CVE Published

via MITRE·03:40 PM

Rejected

via MITRE·03:40 PM

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Does this issue require remediation as a security vulnerability?

No. It was rejected because the behavior was determined not to be a security vulnerability; BusyBox's internal TLS implementation intentionally does not provide full TLS security or peer identity verification.

Are HTTPS downloads using BusyBox internal TLS protected by normal TLS peer verification?

No. The FEATURE_WGET_HTTPS documentation states that the internal TLS support does not verify peer identity and is intentionally minimal.

CVE-2026-88836: Busybox Busybox vulnerability

Affected Software

Event History

Frequently Asked Questions

Does this issue require remediation as a security vulnerability?

Are HTTPS downloads using BusyBox internal TLS protected by normal TLS peer verification?

Company

Resources

Contact

Frequently Asked Questions

Does this issue require remediation as a security vulnerability?

Are HTTPS downloads using BusyBox internal TLS protected by normal TLS peer verification?