Red Hat Security AdvisoryRHSA-2026:72111
Red Hat Hardened Images RPMs Security Update
Released 2026-09-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images busybox-1:1.37.0-9.1.hum1@aarch64, busybox-1:1.37.0-9.1.hum1@src, busybox-1:1.37.0-9.1.hum1@x86_64 +4
Fixes 5 records
Priority LOW 33
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00131 · Published 2026-09-23 · Fixed in 1.37.0-9.1.hum1 CWE-787
Priority LOW 30
BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00124 · Published 2026-09-23 · Fixed in 1.37.0-9.1.hum1 CWE-787
Priority LOW 30
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00237 · Published 2026-09-23 · Fixed in 1.37.0-9.1.hum1 CWE-636
Priority LOW 29
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00273 · Published 2026-09-23 · Fixed in 1.37.0-9.1.hum1 CWE-305
Priority LOW 26
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
CVSS 3.1MEDIUM 6.1· Local · No auth · User interaction · EPSS 0.00117 · Published 2026-09-23 · Fixed in 1.37.0-9.1.hum1 CWE-125
THREATIST.IORead the docs