BusyBox httpd CVE-2026-88837

Exploitation requires the target to run BusyBox httpd with Basic Authentication configured using yescrypt ($y$-prefixed) password hashes - the specific hash format modern Linux distributions default to. If the httpd config uses older crypt formats (MD5 $1$, SHA $5$/$6$) or plaintext credentials, this specific flaw does not apply. The vulnerability is network-reachable and needs no prior authentication (PR:N), but AC:H reflects the dependency on this non-universal yescrypt configuration; realistic exploitation may also require the attacker to know or obtain the stored hash string, since it is being compared literally. Limiting factors: the flaw only matters where BusyBox httpd is actually used as an auth gateway (uncommon in production versus its embedded/container roles) and only where yescrypt hashes are in use.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N = 6.5) describes a network-reachable, unauthenticated authentication-bypass whose exploitation is gated by high attack complexity (AC:H). That AC:H rating is the key signal: exploitation is not point-and-click but conditional on a specific configuration - BusyBox httpd Basic Auth configured with yescrypt ($y$) password hashes. No EPSS score, no CISA KEV listing, and no public POC were supplied, so this is not a demonstrated widespread-exploitation risk; it reads as a real but conditional weakness rather than a mass-exploited threat. The C:H impact (access to protected web content) with only I:L and A:N keeps this in the medium band. There is a mild internal tension worth flagging: the flaw is classed CWE-305 (authentication bypass) yet tagged 'Information Disclosure' - both are defensible since the outcome of the bypass is unauthorized read access, but analysts should treat the primary weakness as an auth-check inversion, not a pure info leak. Overall: a legitimate patch-worthy issue for anyone running the affected configuration, but not an emergency for the general population absent exploitation signals.

A BusyBox httpd instance is configured for Basic Authentication with modern yescrypt ($y$) password hashes (now the default hash format on many current Linux distributions). Because httpd fails to recognize the yescrypt prefix and compares the stored hash as literal plaintext, the intended password check is inverted, letting an attacker reach the protected resource without presenting the genuine credential. No public exploit code was identified at the time of analysis; exploitation depends on the target actually using yescrypt hashes in its httpd config.