AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open

Red Hat

CVE-2026-88831 · Published Sep 23, 2026 · updated Sep 25, 2026

Medium5.3
No fix yet
Red Hat advisory

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-636

More Red Hat advisories

All Red Hat
High 7.5Sep 23Red Hat OpenShift console: path traversalCVE-2026-75887no fix yetHigh 7.2Sep 23Red Hat OpenShift Container Platform 4: attacker could send requestsCVE-2026-75886no fix yetHigh 7.8Sep 23Red Hat librsvg.: use after freeCVE-2026-96889no fix yetMedium 6.6Sep 23Red Hat: argument injectionCVE-2026-84724no fix yetHigh 7.2Sep 23A flaw was found in the Ansible Automation Platform automation controllerCVE-2026-85475no fix yetHigh 7.1Sep 23Red Hat: incomplete denylistCVE-2026-84714no fix yet