CVE-2026-124739
Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
Fixes and workarounds
Workaround
Prevent untrusted users from creating or modifying configuration files by restricting write permissions on all web root and subdirectory paths served by BusyBox httpd to administrative accounts only: chmod -R o-w /path/to/webroot Additionally, ensure the BusyBox httpd process drops elevated privileges by specifying an unprivileged user with the `-u` flag upon execution: busybox httpd -u nobody Restarting the daemon is required for process-level flag changes to take effect, which will temporarily terminate active network connections. Caveats: Running under a non-privileged user account prevents binding directly to privileged ports (below 1024) without additional system capabilities or port forwarding, and restricting directory permissions may interfere with workflows that require unprivileged file uploads.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 6 Red Hat busybox
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Hardened Images Red Hat busybox
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CNA: redhat |
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/security/cve/CVE-2026-124739CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2571613CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-124739[email protected]
- https://bugzilla.redhat.com/show_bug.cgi?id=2571613[email protected]
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.