An update for busybox is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4528 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 busybox security update An update for busybox is now available for openEuler-22.03-LTS-SP4 The Swiss Army Knife of Embedded Linux Security Fix(es): BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.(CVE-2026-88831) BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.(CVE-2026-88832) A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.(CVE-2026-88834) BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.(CVE-2026-88835) BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.(CVE-2026-88837) BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.(CVE-2026-88839) A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.(CVE-2026-88842) An update for busybox is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High busybox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88831 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88832 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88834 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88835 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88837 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88839 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88842 https://nvd.nist.gov/vuln/detail/CVE-2026-88831 https://nvd.nist.gov/vuln/detail/CVE-2026-88832 https://nvd.nist.gov/vuln/detail/CVE-2026-88834 https://nvd.nist.gov/vuln/detail/CVE-2026-88835 https://nvd.nist.gov/vuln/detail/CVE-2026-88837 https://nvd.nist.gov/vuln/detail/CVE-2026-88839 https://nvd.nist.gov/vuln/detail/CVE-2026-88842 openEuler-22.03-LTS-SP4 busybox-1.34.1-38.oe2203sp4.aarch64.rpm busybox-debuginfo-1.34.1-38.oe2203sp4.aarch64.rpm busybox-debugsource-1.34.1-38.oe2203sp4.aarch64.rpm busybox-help-1.34.1-38.oe2203sp4.aarch64.rpm busybox-petitboot-1.34.1-38.oe2203sp4.aarch64.rpm busybox-1.34.1-38.oe2203sp4.src.rpm busybox-1.34.1-38.oe2203sp4.x86_64.rpm busybox-debuginfo-1.34.1-38.oe2203sp4.x86_64.rpm busybox-debugsource-1.34.1-38.oe2203sp4.x86_64.rpm busybox-help-1.34.1-38.oe2203sp4.x86_64.rpm busybox-petitboot-1.34.1-38.oe2203sp4.x86_64.rpm BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. 2026-10-22 CVE-2026-88831 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. 2026-10-22 CVE-2026-88832 openEuler-22.03-LTS-SP4 High 7.3 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected. 2026-10-22 CVE-2026-88834 openEuler-22.03-LTS-SP4 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. 2026-10-22 CVE-2026-88835 openEuler-22.03-LTS-SP4 Medium 6.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. 2026-10-22 CVE-2026-88837 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. 2026-10-22 CVE-2026-88839 openEuler-22.03-LTS-SP4 Medium 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528 A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption. 2026-10-22 CVE-2026-88842 openEuler-22.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N busybox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4528