Red HatCVE-2026-88837
BusyBox httpd treats yescrypt
Medium6.5CVE-2026-88837 · Published Sep 23, 2026 · updated Sep 25, 2026
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-305
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 23 | Red Hat OpenShift Container Platform 4: path traversal | High7.5 | No fix yet |
| Sep 23 | Red Hat OpenShift Container Platform 4: attacker could send requests | High7.2 | No fix yet |
| Sep 23 | Red Hat librsvg.: use after free | High7.8 | No fix yet |
| Sep 23 | Red Hat: argument injection | Medium6.6 | No fix yet |
| Sep 23 | A flaw was found in the Ansible Automation Platform automation controller | High7.2 | No fix yet |
| Sep 23 | Red Hat: incomplete denylist | High7.1 | No fix yet |