Cloudanix VulnDB

CVE-2025-60876

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Nov 10, 2025

CISA due date

—

The record

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

Affected packages

Ecosystem Package Introduced Fixed
Chainguard busybox 0 1.37.0-r50
Chainguard busybox 0 1.37.0-r52
Chainguard busybox-full 0 1.37.0-r52
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS busybox 0 1.35.0-150400.3.14.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS busybox 0 1.35.0-150400.3.14.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS busybox 0 1.37.0-150500.10.14.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS busybox 0 1.37.0-150500.10.14.1
SUSE:Linux Enterprise Server 15 SP4-LTSS busybox 0 1.35.0-150400.3.14.1
SUSE:Linux Enterprise Server 15 SP5-LTSS busybox 0 1.37.0-150500.10.14.1
SUSE:Linux Enterprise Server 15 SP6-LTSS busybox 0 1.37.0-150500.10.14.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 busybox 0 1.35.0-150400.3.14.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 busybox 0 1.37.0-150500.10.14.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 busybox 0 1.37.0-150500.10.14.1
Wolfi busybox 0 1.37.0-r50
Wolfi busybox 0 1.37.0-r52
Wolfi busybox-full 0 1.37.0-r52
openSUSE:Leap 15.6 busybox 0 1.37.0-150500.10.14.1
openSUSE:Leap 15.6 busybox-links 0 1.37.0-150500.7.9.1
openSUSE:Leap 16.0 busybox 0 1.37.0-160000.4.1
openSUSE:Tumbleweed busybox 0 1.37.0-8.1

Related vulnerabilities