Skip to content

Instantly share code, notes, and snippets.

@subyumatest
subyumatest / public.md
Created November 9, 2025 13:58
CVE-2025-60876 writeup

Description

Product: BusyBox (wget) Affected: through 1.37.0 File: networking/wget.c

CWE: 113

Summary: If the request-target (path/query) contains raw CR/LF/C0 or a raw space (0x20), the HTTP request line can be split and attacker-chosen headers injected, enabling cache poisoning / policy bypass.

Vector: A user or automated job fetches a crafted URL that includes CR/LF in the path/query (e.g., via link or redirect).

Mitigation: Reject CR/LF/C0 and raw 0x20 in the request-target; callers should percent-encode (%0D, %0A, %20).