Skip to content
OpenAdvisories
Medium RHSA-2026:62143 2 CVEs

Red Hat Security Advisory: wget security, bug fix, and enhancement update

Published Sep 2, 2026 · Updated Sep 2, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream wget 0:1.21.1-11.el9_8
Red Hat · RHEL 9 enterprise_linux:9::appstream wget-debuginfo 0:1.21.1-11.el9_8
Red Hat · RHEL 9 enterprise_linux:9::appstream wget-debugsource 0:1.21.1-11.el9_8

Vulnerabilities 2

  • Medium 5.9
    CVE-2026-58471

    GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c

    GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character s…

    GNU wget wget wget wget Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-58472

    GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

    GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large …

    GNU wget wget wget wget Debian Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497850
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497857
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62143.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-58471
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58471
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58471
  • article
    https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
  • article
    https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c
  • report
    https://access.redhat.com/security/cve/CVE-2026-58472
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58472
  • article
    https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
  • article
    https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-attribute-encoding