Skip to content
OpenAdvisories
Unscored USN-3643-1 1 CVE

wget vulnerability

Published May 9, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Wget incorrectly handled certain inputs.
An attacker could possibly use this to inject arbitrary cookie values.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS wget 1.15-1ubuntu1.14.04.4
Ubuntu · 16.04 LTS 16.04:LTS wget 1.17.1-1ubuntu1.4
Ubuntu · 18.04 LTS 18.04:LTS wget 1.19.4-1ubuntu2.1

Vulnerabilities 1

  • Unscored —
    CVE-2018-0494 Public exploit EPSS 16%

    GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n seque…

    wget wget wget Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-0494