CVE-2026-88840 — Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Published: 2026-09-23 · CVSS: 5.3 · CVSS 3.1

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7