CVE-2026-16599
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
Risk Assessment
The risk is a denial of service attack on the wget client, potentially leading to process suspension and service unavailability.
Recommendation
Upgrade GNU wget to a version containing the fix (commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa).
Other vulnerabilities in GNU wget
See all- CVE-2016-4971High
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
- CVE-2014-4877High
CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.
- CVE-2024-38428Medium
Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.
- CVE-2026-15146Medium
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port.
- CVE-2026-58472Medium
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c. A remote attacker can exploit a crafted HTML attribute with a large number of characters requiring entity encoding, causing a signed integer overflow, undersized heap allocation, and subsequent heap buffer overflow.
- CVE-2026-58471Medium
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c. The flaw occurs during character set conversion of a server-supplied filename when the reallocation logic miscalculates remaining space, leading to memory corruption.
- CVE-2026-58470Medium
In GNU Wget through version 1.25.0, an integer overflow vulnerability exists in the parse_content_range() function within src/http.c. Attackers can supply malicious Content-Range header values, causing signed integer arithmetic overflow, leading to undefined behavior and download desynchronization.
- CVE-2026-58469High
GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.
Original NVD description (English source)
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa