{ "document": { "aggregate_severity": { "text": "Low" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/vex/2026/cve-2026-76014-els_os-centos6els.json" } ], "tracking": { "current_release_date": "2026-10-19T13:16:52Z", "generator": { "date": "2026-10-19T13:16:52Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-76014-ELS_OS-CENTOS6ELS", "initial_release_date": "2026-08-19T03:16:00Z", "revision_history": [ { "date": "2026-08-19T03:16:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-18T18:54:51Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-10-19T13:16:52Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2026-76014" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "busybox-petitboot-1:1.15.1-21.el6_6.x86_64", "product": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.x86_64", "product_id": "busybox-petitboot-1:1.15.1-21.el6_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/busybox-petitboot@1.15.1-21.el6_6?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-1:1.15.1-21.el6_6.x86_64", "product": { "name": "busybox-1:1.15.1-21.el6_6.x86_64", "product_id": "busybox-1:1.15.1-21.el6_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/busybox@1.15.1-21.el6_6?arch=x86_64&epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product_id": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox-petitboot@1.15.1-21.el6_6.tuxcare.els3?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product_id": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox-petitboot@1.15.1-21.el6_6.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product_id": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox-petitboot@1.15.1-21.el6_6.tuxcare.els1?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product_id": "busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox@1.15.1-21.el6_6.tuxcare.els3?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product_id": "busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox@1.15.1-21.el6_6.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product_id": "busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/busybox@1.15.1-21.el6_6.tuxcare.els1?arch=x86_64&epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64" }, "product_reference": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64" }, "product_reference": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64" }, "product_reference": "busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64" }, "product_reference": "busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64" }, "product_reference": "busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64" }, "product_reference": "busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-petitboot-1:1.15.1-21.el6_6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.x86_64" }, "product_reference": "busybox-petitboot-1:1.15.1-21.el6_6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "busybox-1:1.15.1-21.el6_6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:busybox-1:1.15.1-21.el6_6.x86_64" }, "product_reference": "busybox-1:1.15.1-21.el6_6.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-76014", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "description", "text": "A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-76014" }, { "category": "external", "summary": "https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03", "url": "https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03" }, { "category": "external", "summary": "https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff", "url": "https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff" }, { "category": "external", "summary": "https://github.com/mirror/busybox/issues/124", "url": "https://github.com/mirror/busybox/issues/124" }, { "category": "external", "summary": "https://vuldb.com/cve/CVE-2026-76014", "url": "https://vuldb.com/cve/CVE-2026-76014" }, { "category": "external", "summary": "https://vuldb.com/submit/878212", "url": "https://vuldb.com/submit/878212" }, { "category": "external", "summary": "https://vuldb.com/vuln/391923", "url": "https://vuldb.com/vuln/391923" }, { "category": "external", "summary": "https://vuldb.com/vuln/391923/cti", "url": "https://vuldb.com/vuln/391923/cti" } ], "release_date": "2026-08-19T03:16:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-19T10:33:10.952061Z", "details": "This issue is a null pointer dereference in BusyBox wget’s -T (timeout) handling that can only crash the wget process, with no confidentiality or integrity impact and no path to privilege escalation. Exploitation requires local command execution against a BusyBox build that includes FEATURE_WGET_TIMEOUT, and because wget is a short‑lived client rather than a long‑running, network‑exposed service in server/VM environments, the practical risk to managed enterprise systems is minimal.", "product_ids": [ "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-1:1.15.1-21.el6_6.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els1.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els2.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.tuxcare.els3.x86_64", "CentOS-6:busybox-petitboot-1:1.15.1-21.el6_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] } ] }