CVE-2026-88836: BusyBox TLS Security Issue (Rejected)

CVE-2026-88836 Overview

CVE-2026-88836 was rejected by Red Hat Product Security. The report concerned missing Finished verify_data checking in BusyBox internal TLS, specifically within the FEATURE_WGET_HTTPS implementation. Red Hat determined this behavior does not constitute a security vulnerability.

BusyBox documents that its internal TLS stack is intentionally minimal. The FEATURE_WGET_HTTPS feature explicitly states it does not verify peer identity or provide full TLS security. The absence of Finished verify_data checking aligns with that documented design and does not cross a separate security boundary that would warrant a CVE assignment.

Critical Impact
No security impact. This CVE identifier was rejected and should not be tracked as an active vulnerability in vulnerability management systems.

Affected Products

No affected products — CVE rejected
BusyBox FEATURE_WGET_HTTPS documents the behavior as intentional
No vendor advisories issued

Discovery Timeline

2026-10-13 - CVE-2026-88836 published to NVD and rejected on the same date
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-88836

Vulnerability Analysis

The original report described missing validation of the TLS Finished message verify_data field within BusyBox's internal TLS implementation. In a conformant TLS handshake, both peers exchange Finished messages containing a verify_data value derived from the handshake transcript and master secret. Validating this value prevents handshake tampering by an active network attacker.

Red Hat Product Security rejected the submission because BusyBox explicitly documents its internal TLS stack as non-conformant. The FEATURE_WGET_HTTPS build option states it does not perform peer identity verification or provide full TLS security guarantees. Users enabling this feature accept the documented limitations.

Because the documented design already excludes TLS security guarantees, the absence of verify_data checking does not cross an additional security boundary. The report therefore does not meet the criteria for a CVE assignment.

Root Cause

No security defect exists. The behavior reflects a documented design decision in BusyBox to provide a minimal, non-security-grade TLS implementation suitable for embedded environments where linking a full TLS library is impractical.

Attack Vector

Not applicable. Deployments requiring authenticated or integrity-protected TLS should link BusyBox against OpenSSL or a comparable library rather than rely on FEATURE_WGET_HTTPS.

Detection Methods for CVE-2026-88836

Indicators of Compromise

No indicators of compromise apply. CVE-2026-88836 is a rejected identifier with no associated exploitation activity.
Vulnerability scanners that previously flagged this CVE should be updated to suppress the finding.

Detection Strategies

Audit vulnerability management tooling to confirm rejected CVE identifiers are filtered from active reports.
Inventory BusyBox builds across embedded and container images to identify where FEATURE_WGET_HTTPS is enabled.
Flag use of BusyBox internal TLS for traffic requiring confidentiality or integrity guarantees.

Monitoring Recommendations

Monitor outbound HTTPS traffic originating from embedded devices using BusyBox wget for anomalies consistent with man-in-the-middle activity.
Track configuration drift in container base images that may enable FEATURE_WGET_HTTPS instead of linking a vetted TLS library.

How to Mitigate CVE-2026-88836

Immediate Actions Required

No patching action is required for CVE-2026-88836 because the report was rejected.
Remove or suppress CVE-2026-88836 from internal vulnerability tracking systems to reduce analyst noise.
Review whether any production workflows depend on BusyBox internal TLS for security-sensitive traffic.

Patch Information

No patch has been or will be released for CVE-2026-88836. Red Hat Product Security determined the reported condition is consistent with the documented behavior of FEATURE_WGET_HTTPS and does not require remediation.

Workarounds

Build BusyBox without FEATURE_WGET_HTTPS and link against OpenSSL or mbedTLS when TLS security guarantees are required.
Route sensitive HTTPS requests through a hardened client such as curl compiled with a conformant TLS stack.
Terminate TLS at a trusted proxy that performs full certificate and handshake validation before forwarding traffic to BusyBox endpoints.

bash

# Configuration example: disable BusyBox internal TLS at build time
make menuconfig
# Networking Utilities --->
#   [ ] Enable HTTPS support in wget (FEATURE_WGET_HTTPS)
# Then rebuild and ship wget linked against a conformant TLS library.