Bug 2531346 (CVE-2026-88831)

Summary:	CVE-2026-88831 busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-10 09:46:02 UTC

A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.

This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.