CVE-2026-58470
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In GNU Wget through version 1.25.0, an integer overflow vulnerability exists in the parse_content_range() function within src/http.c. Attackers can supply malicious Content-Range header values, causing signed integer arithmetic overflow, leading to undefined behavior and download desynchronization.
Risk Assessment
The risk involves potential remote disruption of file downloads by the Wget client, which may result in data corruption or unexpected application behavior. Attackers could exploit this vulnerability for man-in-the-middle attacks or to deliver malicious content.
Recommendation
It is recommended to immediately update GNU Wget to a version containing commit 43d3ba9 or later. Additionally, consider limiting trust in Content-Range headers from untrusted sources.
Other vulnerabilities in GNU Wget
See all- CVE-2016-4971High
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
- CVE-2014-4877High
CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.
- CVE-2024-38428Medium
Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.
- CVE-2026-16599Medium
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
- CVE-2026-15146Medium
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port.
- CVE-2026-58472Medium
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c. A remote attacker can exploit a crafted HTML attribute with a large number of characters requiring entity encoding, causing a signed integer overflow, undersized heap allocation, and subsequent heap buffer overflow.
- CVE-2026-58471Medium
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c. The flaw occurs during character set conversion of a server-supplied filename when the reallocation logic miscalculates remaining space, leading to memory corruption.
- CVE-2026-58469High
GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.
Original NVD description (English source)
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.