BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2204-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client     (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2069-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client     (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2053-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: Heap buffer overflow vulnerability in the DHCPv6 client       (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2054-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: Heap buffer overflow vulnerability in the DHCPv6 client       (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6)     DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to     trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option.
    Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to     cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
    (CVE-2026-29004)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318202	SUSE SLES15 Security Update : busybox (SUSE-SU-2026:2204-1)	Nessus	SuSE Local Security Checks	high
317728	SUSE SLES12 Security Update : busybox (SUSE-SU-2026:2069-1)	Nessus	SuSE Local Security Checks	high
316847	SUSE SLES15 Security Update : busybox (SUSE-SU-2026:2053-1)	Nessus	SuSE Local Security Checks	high
316844	SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2026:2054-1)	Nessus	SuSE Local Security Checks	high
312628	Linux Distros Unpatched Vulnerability : CVE-2026-29004	Nessus	Misc.	high

Detections

Analytics

CVE-2026-29004

high

Tenable Plugins

high

high

high

high

high