Medium severity5.1NVD Advisory· Published Jul 15, 2026· Updated Jul 22, 2026
CVE-2026-38754
CVE-2026-38754
Description
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Affected products
10- osv-coords7 versionspkg:apk/chainguard/busyboxpkg:apk/chainguard/busybox-fullpkg:apk/chainguard/busybox-staticpkg:apk/wolfi/busyboxpkg:apk/wolfi/busybox-fullpkg:apk/wolfi/busybox-staticpkg:rpm/opensuse/busybox&distro=openSUSE%20Tumbleweed
< 1.38.0-r0+ 6 more
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-r0
- (no CPE)range: < 1.38.0-2.1
Patches
Vulnerability mechanics
References
3- lists.busybox.net/pipermail/busybox/2026-June/092353.htmlnvdMailing ListPatchVendor Advisory
- busybox.netnvd
- lists.busybox.net/pipermail/busybox/2026-June/092360.htmlnvd
News mentions
0No linked articles in our index yet.