CVE-2026-88834: falha de baixa gravidade em Red Hat Hardened Images
Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.2%
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Red Hat · Red Hat Hardened ImagesCVEs relacionadas — Red Hat Hardened Images
No mesmo produto, das mais perigosas para as menos.
CVE-2026-16445HIGHDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleEPSS 3.2%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2025-32988MEDIUMGnutls: vulnerability in gnutls othername san exportEPSS 1.5%CVE-2025-32989MEDIUMGnutls: vulnerability in gnutls sct extension parsingEPSS 1.5%CVE-2026-1584HIGHGnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binderEPSS 1.4%