BusyBox vulnerabilities by version: what the NVD counts and what no release fixes

How many CVEs does the NVD list for my BusyBox version?

Counted are CVEs whose NVD configuration lists the version as vulnerable, queried on 4 November 2026 through the NVD API without rejected entries, each hit re-checked against its configuration. The NVD lists BusyBox as cpe:2.3:a:busybox:busybox. The column “Shipped in” names which build system or distribution ships that version.

The count does not fall steadily. 1.36.1 has more than 1.35.0, because the NVD lists four awk vulnerabilities from 2023 (CVE-2023-42363 to -42366) only for exactly 1.36.1. Yocto patches them in 1.35.0 as well.

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:busybox:busybox:1.36.1&noRejected"  \
| jq .totalResults

7

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:busybox:busybox:1.38.0&noRejected"  \
| jq .totalResults

3

Which BusyBox CVEs have CVSS 9.0 or higher?

Which BusyBox vulnerabilities does 1.38.0 not fix either?

For these five vulnerabilities there is no BusyBox release with a fix on 4 November 2026. The fixes sit in the development branch, as a submission to the project, or only as a patch of the build systems, and Yocto or Buildroot add each of them to their 1.38.0 themselves. The NVD count does not reflect this: it does not count four of the five for 1.38.0.

Which BusyBox CVEs are missing from the version query?

On 4 November 2026, 20 BusyBox CVEs have no NVD configuration (status “Awaiting Analysis” or “Deferred”) and appear in no version query. 15 of them were published between 23 September and 21 October 2026, 14 with Red Hat as CNA. They concern httpd, the TLS code, udhcpc, tar, dpkg and mount, among others. Debian lists all 15 as open in its 1.38.0 package, one of them as unimportant.

BusyBox has published no release since 1.38.0. Fixes for tar and httpd from October 2026 sit only in the development branch.

Which BusyBox version do Yocto, OpenWrt and Buildroot ship?

Read from the recipes at the release tags and branches, as of 4 November 2026: Yocto meta/recipes-core/busybox/busybox_<version>.bb, OpenWrt package/utils/busybox/Makefile, Buildroot package/busybox/busybox.mk. Counted are patches that carry a CVE in their name or header.

The patches do not change the version line. A Yocto 5.0 build reports “BusyBox v1.36.1”, and CVE-2022-48174 is fixed in it. An OpenWrt 24.10 build reports the same version, and none of its twelve patches is for ash. A match by version alone cannot tell the two apart. Buildroot 2026.02.3 carries fewer BusyBox patches than 2025.02.19: the fixes for CVE-2026-29004, -26157 and -26158 are missing there.

Where is the BusyBox version in the binary?

BusyBox writes its version into the binary as one contiguous string, in bb_banner from libbb/messages.c: “BusyBox v”, the version and a suffix in brackets. In the original the suffix is the build time in the format YYYY-MM-DD hh:mm:ss UTC. Distributions set text of their own, Debian for example the package version. On the device, busybox without arguments prints the same line, followed by “multi-call binary.”

The line names the upstream version. Patches of the build system are not in it; they are in the build's recipe.

$ curl -s https://raw.githubusercontent.com/mirror/busybox/1_38_0/libbb/messages.c  \
| grep -n -E "bb_banner\[\]|define BB_EXTRA_VERSION"

11:#define BB_EXTRA_VERSION " ("AUTOCONF_TIMESTAMP")"
14:const char bb_banner[] ALIGN1 = "BusyBox v" BB_VER BB_EXTRA_VERSION;

$ strings -a usr/bin/busybox | grep -m1 "^BusyBox v"

BusyBox v1.37.0 (Debian 1:1.37.0-6+b9)

How do I check this by hand?

1. 1

   Read the version: strings -a bin/busybox | grep -m1 "^BusyBox v" in the unpacked file system, on the device busybox | head -1.

2. 2

   Clarify the origin: Yocto, Buildroot, OpenWrt or a build of your own. For Yocto and Buildroot read the patches in the recipe; they are not in the version line.

3. 3

   Determine the applets: busybox --list on the device or the build's .config. A vulnerability in httpd, udhcpc6, tar or dpkg only affects builds that contain that applet.

4. 4

   Network applets first: udhcpc, udhcpc6, httpd, wget and ntpd are reachable from the network, awk and the shell mostly only through local input.

5. 5

   Query the NVD with cpe:2.3:a:busybox:busybox:<version>, then read the CVEs without NVD mapping against your version, for example in Debian's security tracker for busybox.

6. 6

   Check the CISA KEV catalogue for actively exploited vulnerabilities.

Can this run automatically?

LegacyMind reads BusyBox, the kernel and the packages with their versions from the image and checks each against the public vulnerability sources, with the place in the image where it was found and a note whether a vulnerability is actively exploited. If the image proves no version, the field stays empty.