CVE-2026-88833: falha de média gravidade em Red Hat Hardened Images
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.2%
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Red Hat · Red Hat Hardened ImagesCVEs relacionadas — Red Hat Hardened Images
No mesmo produto, das mais perigosas para as menos.
CVE-2026-16445HIGHDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleEPSS 3.2%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2025-32988MEDIUMGnutls: vulnerability in gnutls othername san exportEPSS 1.5%CVE-2025-32989MEDIUMGnutls: vulnerability in gnutls sct extension parsingEPSS 1.5%CVE-2025-6021HIGHLibxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2EPSS 1.4%