Bug 2571614

Summary: CVE-2026-124739 busybox: httpd stack buffer overflow via an "I:" rule in a subdirectory httpd.conf [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: busyboxAssignee: Tom "spot" Callaway <spotrh>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: admiller, davide, dvlasenk, epel-packagers-sig, spotrh, suraj.ghimire7
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8a63ad6b-60c9-4617-873c-84923965450d"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2571613    

Description Vladimir Vasilev 2026-11-11 09:38:22 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in BusyBox's httpd. handle_incoming_and_exit() allocates a stack copy of the request URL sized for the current index page name, then parses the httpd.conf file of each directory on the requested path, and finally copies the index page name into that buffer with strcpy(). Because parse_conf() honors an "I:" index-page rule in subdirectory httpd.conf files, an overly long index page name in such a file overflows the stack buffer with attacker-chosen bytes when the directory is requested. A user who can write a subdirectory httpd.conf can use this to crash httpd or potentially execute arbitrary code in the forked child process, which runs as root unless the -u option is used.