Buffer Overflow in BusyBox TLS ClientHello Processing
CVE-2026-88840

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Vendor
CVE Published:
23 September 2026

What is CVE-2026-88840?

A buffer overflow vulnerability exists in BusyBox TLS within the get_client_hello() function. This issue arises when parsing a truncated ClientHello message, leading the function to read beyond the allocated input buffer. Such behavior can potentially be exploited to affect application stability and may open avenues for unauthorized access or additional vulnerabilities, highlighting the importance of proper input validation mechanisms.

References

https://access.redhat.com/security/cve/CVE-2026-88840
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531354
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.