REDHAT-BUG-2571613: High severity vulnerability

Published Nov 11, 2026

Updated

A flaw was found in BusyBox's httpd. handleincomingandexit() allocates a stack copy of the request URL sized for the current index page name, then parses the httpd.conf file of each directory on the requested path, and finally copies the index page name into that buffer with strcpy(). Because parseconf() honors an "I:" index-page rule in subdirectory httpd.conf files, an overly long index page name in such a file overflows the stack buffer with attacker-chosen bytes when the directory is requested. A user who can write a subdirectory httpd.conf can use this to crash httpd or potentially execute arbitrary code in the forked child process, which runs as root unless the -u option is used.

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:35 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

BusyBox httpd deployments are exposed when an untrusted or lower-privileged user can write a subdirectory httpd.conf file beneath content served by httpd. The impact is greater when httpd runs without the -u option, because the affected forked child process runs as root.

What does an attacker need to exploit it?

The attacker needs the ability to create or modify a subdirectory httpd.conf and set an overly long I: index-page rule. They must then cause a request for that directory, which triggers the unsafe copy into a stack buffer.

Is this reachable through a normal request, or does it require a special server configuration?

It is triggered by requesting a directory whose subdirectory httpd.conf contains the malicious I: rule. The vulnerable behavior depends on httpd honoring per-directory httpd.conf files and their index-page settings.

What can be done if patching is not immediately possible?

Prevent untrusted users from writing subdirectory httpd.conf files in served paths, and review existing files for unusually long I: index-page rules. Running httpd with the -u option can reduce the privilege of the affected child process, though it does not prevent the crash or overflow.

How can administrators check for attempted or existing exposure?

Inspect directory-level httpd.conf files under the web root for I: directives, especially values with unusually long index page names. Also identify whether untrusted users have write access to directories that httpd serves.

REDHAT-BUG-2571613: High severity vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Is this reachable through a normal request, or does it require a special server configuration?

What can be done if patching is not immediately possible?

How can administrators check for attempted or existing exposure?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Is this reachable through a normal request, or does it require a special server configuration?

What can be done if patching is not immediately possible?

How can administrators check for attempted or existing exposure?