Skip to content
OpenAdvisories
Medium ALSA-2026:62144 3 CVEs

Moderate: wget security, bug fix, and enhancement update

Published Sep 1, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es):

* wget: GNU Wget: Memory corruption via crafted Metalink URL (CVE-2026-58469)
* wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471)
* wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472)

Bug Fix(es) and Enhancement(s):

* wget async unsafe code in signal handler context [almalinux-8.10.z] (JIRA:AlmaLinux-145875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 wget 1.19.5-16.el8_10

Vulnerabilities 3

  • High 7.5
    CVE-2026-58469

    GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing

    GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containin…

    GNU wget wget wget wget Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-58471

    GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c

    GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character s…

    GNU wget wget wget wget Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-58472

    GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

    GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large …

    GNU wget wget wget wget Debian Ubuntu Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-58469
  • report
    https://access.redhat.com/security/cve/CVE-2026-58471
  • report
    https://access.redhat.com/security/cve/CVE-2026-58472
  • report
    https://bugzilla.redhat.com/2497838
  • report
    https://bugzilla.redhat.com/2497850
  • report
    https://bugzilla.redhat.com/2497857
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-62144.html