Debian/busybox: medium 6.5
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be
Action: Upgrade busybox to 1:1.37.0-8 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:1.37.0-8 | - |
Fixed versions
| 1:1.37.0-8 |
Sources
- osv: DEBIAN-CVE-2025-60876#Debian:14/busybox
- https://security-tracker.debian.org/tracker/CVE-2025-60876
published · modified · JSON