Log in Start free

Vulnerability · Published Nov 10, 2025 · Assigned by mitre

CVE-2025-60876

Medium 6.5

In plain English

A medium-severity improper access control in the busybox package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12busyboxno fix listedDEBIAN-CVE-2025-60876
Debian:13busyboxno fix listedDEBIAN-CVE-2025-60876
Debian:14busybox1:1.37.0-8DEBIAN-CVE-2025-60876
Ubuntu:22.04:LTSbusyboxno fix listedUBUNTU-CVE-2025-60876
Ubuntu:24.04:LTSbusyboxno fix listedUBUNTU-CVE-2025-60876
Ubuntu:25.10busyboxno fix listedUBUNTU-CVE-2025-60876
Ubuntu:26.04:LTSbusyboxno fix listedUBUNTU-CVE-2025-60876
Ubuntu:26.10busyboxno fix listedUBUNTU-CVE-2025-60876

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References