Bug 2531351 (CVE-2026-88837)

Summary: CVE-2026-88837 busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-10 09:48:18 UTC 
A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."

Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.