Skip to content
OpenAdvisories
High RHSA-2026:62144 3 CVEs

Red Hat Security Advisory: wget security, bug fix, and enhancement update

Published Sep 2, 2026 · Updated Sep 2, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream wget 0:1.19.5-16.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream wget-debuginfo 0:1.19.5-16.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream wget-debugsource 0:1.19.5-16.el8_10

Vulnerabilities 3

  • High 7.5
    CVE-2026-58469

    GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing

    GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containin…

    GNU wget wget wget wget Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-58471

    GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c

    GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character s…

    GNU wget wget wget wget Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-58472

    GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

    GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large …

    GNU wget wget wget wget Debian Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497838
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497850
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497857
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62144.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-58469
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58469
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58469
  • article
    https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
  • article
    https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalink-url-parsing
  • report
    https://access.redhat.com/security/cve/CVE-2026-58471
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58471
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58471
  • article
    https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
  • article
    https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c
  • report
    https://access.redhat.com/security/cve/CVE-2026-58472
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58472
  • article
    https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
  • article
    https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-attribute-encoding