CVE-2026-88831: BusyBox httpd DOS Vulnerability

CVE-2026-88831 Overview

CVE-2026-88831 affects BusyBox httpd, the embedded HTTP server bundled with BusyBox in many Linux-based appliances, containers, and embedded devices. The flaw resides in the parsing of IP-based access control rules (A: and D: directives) inside httpd.conf. When an administrator supplies an invalid Classless Inter-Domain Routing (CIDR) prefix length, BusyBox parses the IP address but leaves the network mask zeroed. The resulting rule matches no clients and silently fails open. Attackers can reach resources the administrator intended to restrict, defeating IP-based deny lists on the embedded web server.

Critical Impact
IP-based deny rules with malformed CIDR prefixes are silently ignored, allowing unauthenticated network clients to bypass access controls on BusyBox httpd.

Affected Products

BusyBox httpd component (versions tracked in the Red Hat advisory)
Linux distributions and container images shipping the affected BusyBox build
Embedded devices and appliances that expose BusyBox httpd with CIDR-based ACLs

Discovery Timeline

2026-09-23 - CVE-2026-88831 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-88831

Vulnerability Analysis

BusyBox httpd supports allow (A:) and deny (D:) directives that accept an IP address followed by an optional CIDR prefix length. The rule parser converts the textual prefix into a bitmask applied to incoming client addresses. When the prefix length falls outside the valid range, the parser accepts the address but does not populate the mask, leaving it at zero.

A zeroed mask combined with a non-zero IP produces a comparison that never matches any client address. The deny rule remains loaded but is functionally inert. Administrators who audit the configuration see the rule present and assume enforcement is active. This mismatch between configured intent and runtime behavior is the essence of the [CWE-636] "Not Failing Securely (Failing Open)" weakness assigned to this CVE.

The issue is exploitable over the network without authentication or user interaction. Confidentiality of restricted resources served by httpd is the primary concern; integrity and availability are not directly affected.

Root Cause

The rule-parsing routine does not reject invalid CIDR prefix lengths. Instead of returning an error and dropping the malformed rule, the function proceeds with a default mask value of zero. The bitwise match (client_ip & mask) == (rule_ip & mask) always evaluates against 0 == 0 on the rule side but against client_ip & 0 on the client side, producing an unmatched comparison for every non-null address. The fail-open behavior contradicts the fail-safe default expected of an access control component.

Attack Vector

An unauthenticated remote attacker sends standard HTTP requests to the BusyBox httpd instance from a source IP the administrator intended to block. Because the deny rule was neutralized at configuration parse time, the request is processed normally. Exploitation requires no special tooling. The attacker only needs network reachability to the listener and knowledge that a target resource exists behind the ineffective ACL. See the Red Hat CVE-2026-88831 Advisory for technical details.

Detection Methods for CVE-2026-88831

Indicators of Compromise

HTTP access log entries from source IPs listed in D: deny directives of httpd.conf
Successful 2xx responses to restricted URIs from client addresses outside expected allow ranges
BusyBox httpd startup with configuration files containing CIDR suffixes greater than /32 for IPv4 rules

Detection Strategies

Parse httpd.conf files across the fleet and flag any A: or D: line whose CIDR prefix length is missing, non-numeric, or outside 0-32
Correlate web server access logs with the deny list to identify requests that should have been rejected but were served
Run configuration linting during image build and container CI/CD pipelines to catch malformed ACL entries before deployment

Monitoring Recommendations

Ingest BusyBox httpd access and error logs into a centralized log platform for retention and search
Alert on requests to sensitive paths from source networks that appear in deny directives
Baseline expected client subnets per service and alert on deviations after configuration changes

How to Mitigate CVE-2026-88831

Immediate Actions Required

Inventory systems running BusyBox httpd and review every httpd.conf for malformed CIDR prefixes
Correct any invalid prefix lengths so that IPv4 rules use /0 through /32 and IPv6 rules use /0 through /128
Where feasible, enforce access control at an upstream firewall or reverse proxy rather than relying solely on BusyBox httpd ACLs

Patch Information

Refer to the Red Hat CVE-2026-88831 Advisory and Red Hat Bug Report #2531346 for the fixed BusyBox package versions applicable to each supported distribution. Rebuild and redeploy container images and embedded firmware that bundle BusyBox once patched packages are available.

Workarounds

Move IP allow/deny enforcement to an external component such as iptables, nftables, or a reverse proxy that validates CIDR syntax strictly
Replace CIDR-based rules with explicit single-host entries that do not depend on prefix parsing
Restrict network exposure of the BusyBox httpd listener to trusted management segments until patched packages are deployed

bash

# Configuration example: validate httpd.conf ACL entries before deployment
grep -E '^[AD]:' /etc/httpd.conf | awk -F'[:/]' '{
  if (NF >= 3 && ($3 < 0 || $3 > 32)) print "INVALID CIDR: " $0
}'