PT-2025-46190 · Busybox+2 · Busybox+2

Subyumatest · Published 2025-11-10 · Updated 2026-04-11 · CVE-2025-60876

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BusyBox versions through 1.3.7

Description The software accepts raw CR (0x0D)/LF (0x0A) and other C0 control bytes within the HTTP request-target (path/query). This allows an attacker to split the request line and inject controlled headers. Specifically, the software fails to reject raw spaces (0x20) within the request-target, which should be encoded as '%20'. This impacts the HTTP/1.1 request-line structure, which requires a space between the request-target and the HTTP version.

Recommendations Update BusyBox to a version later than 1.3.7.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

AZL-69985

AZL-70043

BDU:2026-05705

CVE-2025-60876

OESA-2026-1879

OESA-2026-1880

OESA-2026-1881

OPENSUSE-SU-2025:15834-1

OPENSUSE-SU-2026:20090-1

RHSA-2026:7418

SUSE-SU-2026:0235-1

SUSE-SU-2026:0236-1

SUSE-SU-2026:0872-1

SUSE-SU-2026:0892-1

SUSE-SU-2026:20134-1

Affected Products

Busybox

Debian

Red Os

References · 60

• 🔥 https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:20090-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-60876 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1879 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-60876 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1880 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15834-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20134-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60876 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0236-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-60876 · Security Note
• https://osv.dev/vulnerability/AZL-70043 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1881 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69985 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05705 · Security Note