Bug 2571613 (CVE-2026-124739)

Summary: CVE-2026-124739 busybox: httpd stack buffer overflow via an "I:" rule in a subdirectory httpd.conf
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2571614, 2571615    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-11 09:35:26 UTC 
A flaw was found in BusyBox's httpd. handle_incoming_and_exit() allocates a stack copy of the request URL sized for the current index page name, then parses the httpd.conf file of each directory on the requested path, and finally copies the index page name into that buffer with strcpy(). Because parse_conf() honors an "I:" index-page rule in subdirectory httpd.conf files, an overly long index page name in such a file overflows the stack buffer with attacker-chosen bytes when the directory is requested. A user who can write a subdirectory httpd.conf can use this to crash httpd or potentially execute arbitrary code in the forked child process, which runs as root unless the -u option is used.