BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

According to the versions of the busybox packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-     target (path/query), allowing the request line to be split and attacker-controlled headers to be injected.
    To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in     the request-target must also be rejected (clients should use %20).(CVE-2025-60876)

    BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6)     DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to     trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option.
    Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to     cause denial of service or achieve arbitrary code execution on embedded systems without heap     hardening.(CVE-2026-29004)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-     target (path/query), allowing the request line to be split and attacker-controlled headers to be injected.
    To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in     the request-target must also be rejected (clients should use %20).(CVE-2025-60876)

    BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6)     DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to     trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option.
    Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to     cause denial of service or achieve arbitrary code execution on embedded systems without heap     hardening.(CVE-2026-29004)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2204-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client     (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2069-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client     (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2053-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: Heap buffer overflow vulnerability in the DHCPv6 client       (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2054-1 advisory.

    This update for busybox fixes the following issue

    - CVE-2026-29004: Heap buffer overflow vulnerability in the DHCPv6 client       (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c (bsc#1263989).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6)     DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to     trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option.
    Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to     cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
    (CVE-2026-29004)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326645	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2026-2682)	Nessus	Huawei Local Security Checks	high
326625	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2026-2641)	Nessus	Huawei Local Security Checks	high
326198	EulerOS 2.0 SP12 : busybox (EulerOS-SA-2026-2581)	Nessus	Huawei Local Security Checks	high
326107	EulerOS 2.0 SP12 : busybox (EulerOS-SA-2026-2521)	Nessus	Huawei Local Security Checks	high
318202	SUSE SLES15 Security Update : busybox (SUSE-SU-2026:2204-1)	Nessus	SuSE Local Security Checks	high
317728	SUSE SLES12 Security Update : busybox (SUSE-SU-2026:2069-1)	Nessus	SuSE Local Security Checks	high
316847	SUSE SLES15 Security Update : busybox (SUSE-SU-2026:2053-1)	Nessus	SuSE Local Security Checks	high
316844	SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2026:2054-1)	Nessus	SuSE Local Security Checks	high
312628	Linux Distros Unpatched Vulnerability : CVE-2026-29004	Nessus	Misc.	high

Detections

Analytics

CVE-2026-29004

high

Tenable Plugins

high

high

high

high

high

high

high

high

high