Threats Tagged 'oesa-2026-4529'

BusyBox httpd contains a vulnerability where IP deny rules with invalid CIDR prefix lengths fail open, resulting in a parsed IP with a zeroed mask that matches no clients. This issue affects multiple BusyBox versions including various Ubuntu and Red Hat Hardened Images releases. The vulnerability has a CVSS score of 5.3 (medium severity). Red Hat has released updated BusyBox packages (version 1.37.0-9.1.hum1) addressing this and related CVEs.