CVE-2025-60876: BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

criticalCVSS 9.4CVE-2025-60876

CSIRTS triage

What: Insufficient sanitization of HTTP request-target allows control characters to split request lines and inject attacker-controlled headers.
Who is affected: All deployments of BusyBox wget version 1.3.7 and earlier are vulnerable to HTTP header injection.
Urgency: Critical; active exploitation likely; HTTP header injection enables cache poisoning, request smuggling, and credential theft.
Action: Upgrade BusyBox wget immediately to version 1.35.0 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch BusyBox wget

Get an email when a new BusyBox wget advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-608760.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2025-60876	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.