security alerts in busybox

[Aaro Koskinen]

Hi,

On Fri, Apr 24, 2026 at 04:40:47PM +0200, Roberto A. Foglietta via busybox wrote:
> Are these false positives? Well, it is more about corner cases like
> using the applet in a strong parallel mode like xargs -p8 does. If
> used for maintenance on a large enough infrastructure, the corner case
> has a chance to be met, for example.

Busybox doesn't create threads, so ctime() is not a problem. I think
you meant xargs -P and that forks.

A.