CVE-2026-88840 BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message

Description

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Hardened Images	Versions not published

Other CVEs of Red Hat Hardened Images

The 381 CVEs of Red Hat Hardened Images →

CVE-2026-123876 Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation 4.4 Medium CVE-2026-120749 Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus 6.2 Medium CVE-2026-111253 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction 6.6 Medium CVE-2026-123151 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail Not rated