Re: Information related to fix for CVE-2026-38753 , CVE-2026-38754 , CVE-2026-38755

On Thu, 2026-07-23 at 19:56 +0200, Stefan Seyfried via busybox wrote:
> Am 23.07.26 um 16:24 schrieb Neeru Gupta via busybox:
> > Dear Team ,
> > 
> > We are recently seeing below 3 High CVEs being reported in Busybox 1.38 in
> > our security scans.
> 
> This sounds like you are using busybox in a commercial environment.
> 
> > Can anyone please help in sharing information on how do
> > I get to know once fix for below CVEs are delivered to source code. ?
> 
> I might have missed it, but I did not see any patches adressing those CVEs.

Hi,

I _believe_ that the following are proposed patches for those three CVEs:

https://lists.busybox.net/pipermail/busybox/2026-June/092352.html
https://lists.busybox.net/pipermail/busybox/2026-June/092353.html
https://lists.busybox.net/pipermail/busybox/2026-June/092354.html

All were contributed by Sanghyun Park.

With kind regards,

David