Bug 2519381 (CVE-2026-76014)

Summary:	CVE-2026-76014 busybox: BusyBox: Denial of Service via null pointer dereference in wget.c
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aprice, bsquizza, cmitchel, dfreiber, drow, elicohen, gbenhaim, jburrell, jsamir, kaycoth, kshier, niyer, oezr, rhel-process-autobot, stcannon, teagle, twaugh, vkumar, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in BusyBox. A local attacker can exploit a null pointer dereference vulnerability in the FEATURE_WGET_TIMEOUT handler within the networking/wget.c component. This occurs when the attacker manipulates the -T argument, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2529710, 2529711
Bug Blocks:

Description OSIDB Bzimport 2026-08-19 03:11:29 UTC

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.