BusyBox httpd CVE-2026-88831

Exploitation requires that BusyBox httpd is deployed AND an administrator has configured an IP-based access control (deny) rule using an invalid CIDR prefix length; the buggy parsing then produces a zeroed netmask so the rule matches no clients and fails open. The limiting factor is this administrator-side precondition - with correctly-formed deny rules the flaw does not manifest, so it is a latent configuration-dependent weakness rather than an out-of-the-box remote bug. It is otherwise reachable by any network client with no authentication or user interaction (per PR:N/UI:N), and impact is confined to bypassing the intended IP restriction (confidentiality-only).

This is a moderate, defense-weakening flaw rather than a direct compromise primitive. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) reflects a network-reachable, unauthenticated confidentiality-only impact, and CWE-636 (Not Failing Securely) correctly frames the root cause: a BusyBox httpd IP deny rule written with an invalid CIDR prefix length parses into an IP with a zeroed mask, so the rule matches no clients and the intended block silently fails open. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so no exploitation-probability or automatability signal is available to raise or lower priority; SSVC framework fields were not supplied. Critically, exploitation is contingent on an administrator having ALREADY misconfigured a deny rule with an invalid prefix - the attacker does not create the condition, they merely benefit from it - which makes this closer to a latent access-control failure than an actively weaponizable network bug. The C:L (not C:H) rating is appropriate because the payoff is only access to whatever the deny rule was meant to protect, not a full data breach or code execution. Net: real but low-to-moderate priority, best treated as a hardening/config-audit item. Note also a source/scoping tension - the underlying software is BusyBox httpd, but the CPE and tags scope it to Red Hat Hardened Images; verify which packaged BusyBox versions are actually affected with the Red Hat advisory.

An administrator configures BusyBox httpd to deny a range of client IPs but mistypes the CIDR prefix length (e.g. an out-of-range mask), causing the rule to parse with a zeroed mask that matches no one. An attacker whose address should have been blocked simply connects over the network and reaches the content or endpoint the deny rule was intended to protect. No authentication or special tooling is required, but no public exploit code is identified at time of analysis and success depends entirely on the pre-existing misconfiguration.