Hi,

The following vulnerability was published for busybox.

CVE-2026-88834[0]:
| A flaw was found in BusyBox's httpd web server. When configured with
| system password authentication, a user existence oracle may exist in
| certain build configurations. An attacker could distinguish existing
| from non-existing usernames by observing authentication failure
| behavior. Impact is limited to username enumeration and requires
| non-default compile options or uncommon password file states;
| default BusyBox builds with shadow password support are not
| affected.

https://bugzilla.redhat.com/show_bug.cgi?id=2531348


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88834
https://www.cve.org/CVERecord?id=CVE-2026-88834

Please adjust the affected versions in the BTS as needed.