CVE-2026-38755

Опубликовано: 15 июл. 2026

Источник: nvd

CVSS3: 2.9

CVSS3: 7.5

EPSS Низкий

Описание

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Ссылки

https://busybox.net
https://lists.busybox.net/pipermail/busybox/2026-June/092354.html
Mailing List
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*

EPSS

Процентиль: 11%

0.00207

Низкий

2.9 Low

CVSS3

7.5 High

CVSS3

Дефекты

CWE-674

CWE-122

Связанные уязвимости

CVE-2026-38755

CVSS3: 2.9

ubuntu

22 дня назад

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVE-2026-38755

CVSS3: 5.5

redhat

23 дня назад

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVE-2026-38755

CVSS3: 7.5

msrc

17 дней назад

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVE-2026-38755

CVSS3: 2.9

debian

22 дня назад

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox ...

GHSA-jcqv-rj94-jmx3

CVSS3: 7.5

github

22 дня назад

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

EPSS

Процентиль: 11%

0.00207

Низкий

2.9 Low

CVSS3

7.5 High

CVSS3

Дефекты

CWE-674

CWE-122