A denial-of-service vulnerability exists in barebox versions prior to 2026.04.0 due to improper validation of directory entry lengths in ext4 filesystem parsing. Specifically, the ext4fs_iterate_dir() function does not check that directory entry length values are non-zero, allowing crafted ext4 filesystem images with zero-length directory entries to cause an infinite loop. This results in the boot process hanging indefinitely.