Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
BusyBox httpd can reveal valid usernames
published 22 days ago
Summary
The BusyBox web server included in the Azure BusyBox package can tell whether a username exists when it is set up to use system password authentication and compiled with certain uncommon options. This only allows an attacker to confirm usernames, not to log in, and it only affects non‑default builds. Use the standard BusyBox build or disable system password authentication to eliminate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | busybox | <= 1.36.1-27 |
Original advisory text
CVE-2026-88834 affecting package busybox 1.36.1-27
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
References
Timeline
Published13 Oct 2026
Updated17 Oct 2026
First seen17 Oct 2026
Sources
AZL-108318 · OSV
Track software like this
Free during beta