AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Red HatCVE-2026-88837

BusyBox httpd treats yescrypt

Red Hat

CVE-2026-88837 · Published Sep 23, 2026 · updated Sep 25, 2026

Medium6.5
No fix yet
Red Hat advisory

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-305

More Red Hat advisories

All Red Hat
High 7.5Sep 23Red Hat OpenShift console: path traversalCVE-2026-75887no fix yetHigh 7.2Sep 23Red Hat OpenShift Container Platform 4: attacker could send requestsCVE-2026-75886no fix yetHigh 7.8Sep 23Red Hat librsvg.: use after freeCVE-2026-96889no fix yetMedium 6.6Sep 23Red Hat: argument injectionCVE-2026-84724no fix yetHigh 7.2Sep 23A flaw was found in the Ansible Automation Platform automation controllerCVE-2026-85475no fix yetHigh 7.1Sep 23Red Hat: incomplete denylistCVE-2026-84714no fix yet