Skip to content
CommonLayer

CVE-2025-60876 · commonlayer-org/base

Vulnerability finding.
  • Lifecycle ·Maintenance degraded
  • Funding ·Underfunded
  • Security ·Open issues within SLA
Fund commonlayer-org/base

Description

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

Affected digests

Every digest this vulnerability was found in. A fix under a new digest never changes an old one: older digests stay affected.
Affected digests
DigestPackageStatus
basesha256:7901b113c8cb…7f26c9busybox 1.37.0-r31
Supported digestPresent
basesha256:7901b113c8cb…7f26c9busybox-binsh 1.37.0-r31
Supported digestPresent

Exceptions

  • CVE-2025-60876Exception:RequestedNot applicable
    Justification
    wget is removed in base image building
    Mitigation
    wget is removed in base image building
    Requested
    by bheitmann
    New remediation date
    Expires

Timeline

  1. Opened— → Open · System
  2. AcknowledgedOpen → Acknowledged · bheitmann
  3. Exception requested · bheitmann