GNU Wget

SSRF via Unvalidated FTP PASV IP in GNU Wget <1.25.0
CVE-2026-15146 5.9 - Medium - July 10, 2026

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wgets data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

Heap Buffer Overflow in GNU Wget 1.25.0 html_quote_string() (convert.c)
CVE-2026-58472 5.9 - Medium - July 07, 2026

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

Integer Overflow or Wraparound

GNU Wget 1.25.0 Heap Buffer Overflow (convert_fname)
CVE-2026-58471 5.9 - Medium - July 07, 2026

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.

Heap-based Buffer Overflow

Wget 1.25.0 Integer Overflow in parse_content_range()
CVE-2026-58470 5.3 - Medium - July 07, 2026

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.

Integer Overflow or Wraparound

GNU Wget <1.25.0 Heap Buffer Underread in clean_metalink_string
CVE-2026-58469 7.5 - High - July 07, 2026

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

Out-of-bounds Read

wget2 TLS Cert Validation Bypass: Key Usage/EKU Mismatch
CVE-2026-1858 4.8 - Medium - April 29, 2026

wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

Improper Input Validation

Wget Arbitrary Host Access Vulnerability via Shorthand URL Credential Injection
CVE-2024-10524 - November 19, 2024

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

SSRF

GNU Wget <=1.24.5 URL.C Userinfo Semicolon Misinterpretation
CVE-2024-38428 9.1 - Critical - June 16, 2024

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Interpretation Conflict

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin
CVE-2021-31879 6.1 - Medium - April 29, 2021

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Open Redirect

Buffer overflow in GNU Wget 1.20.1 and earlier
CVE-2019-5953 9.8 - Critical - May 17, 2019

Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

Memory Corruption

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which
CVE-2018-20483 - December 26, 2018

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c
CVE-2018-0494 6.5 - Medium - May 06, 2018

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Improper Input Validation

GNU wget before 1.18
CVE-2016-4971 8.8 - High - June 30, 2016

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.
CVE-1999-0402 - January 02, 1999

wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.