BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 10 Nov 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20). | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-11-10T19:49:21.240Z
Reserved: 2025-09-26T00:00:00.000Z
Link: CVE-2025-60876
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-10T20:15:48.683
Modified: 2025-11-10T20:15:48.683
Link: CVE-2025-60876
Redhat
No data.
OpenCVE Enrichment
No data.