CVE-2025-60876
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-12-31

Assigner: MITRE

Description
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-10
Last Modified
2025-12-31
Generated
2026-05-07
AI Q&A
2025-11-10
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
busybox busybox to 1.37.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in BusyBox wget versions through 1.3.7 allows an attacker to inject headers into an HTTP request by including raw carriage return (CR), line feed (LF), and other control characters in the HTTP request-target (path or query). This happens because the software accepts these control bytes, enabling the attacker to split the HTTP request line and insert malicious headers. To maintain proper HTTP/1.1 request-line formatting, raw spaces in the request-target must also be rejected.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to perform HTTP request smuggling or header injection attacks, potentially leading to unauthorized actions, information disclosure, or bypassing security controls by manipulating HTTP requests sent by BusyBox wget.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart