CVE-2025-60876
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-12-31
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| busybox | busybox | to 1.37.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in BusyBox wget versions through 1.3.7 allows an attacker to inject headers into an HTTP request by including raw carriage return (CR), line feed (LF), and other control characters in the HTTP request-target (path or query). This happens because the software accepts these control bytes, enabling the attacker to split the HTTP request line and insert malicious headers. To maintain proper HTTP/1.1 request-line formatting, raw spaces in the request-target must also be rejected.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform HTTP request smuggling or header injection attacks, potentially leading to unauthorized actions, information disclosure, or bypassing security controls by manipulating HTTP requests sent by BusyBox wget.