CVE-2026-88831 — CVSS 5.3 MEDIUM

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Loading application…