Summary
It was discovered that Wget mishandled semicolons in the userinfo
subcomponent of a URL. A remote attacker could possibly use this issue
to trick a user into connecting to a different host than intended. This
issue only affected Ubuntu 14.04 LTS. (CVE-2024-38428)
It was discovered that Wget incorrectly handled Metalink documents
containing a whitespace-only URL. A remote attacker could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-58469)
It was discovered that Wget incorrectly handled Content-Range header
values, leading to an integer overflow. A remote attacker could
possibly use this issue to cause download desynchronization.
(CVE-2026-58470)
It was discovered that Wget incorrectly handled character set
conversion of server-supplied filenames. A remote attacker could possibly
use this issue to cause a denial of service or possibly execute arbitrary
code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58471)
It was discovered that Wget incorrectly handled HTML attributes
requiring entity encoding. A remote attacker could possibly use this issue
to cause a denial of service or possibly execute arbitrary code.
(CVE-2026-58472)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | wget | 1.21.2-2ubuntu1.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | wget | 1.21.4-1ubuntu4.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | wget | 1.25.0-2ubuntu4.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | wget | 1.15-1ubuntu1.14.04.5+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | wget | 1.17.1-1ubuntu1.5+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | wget | 1.19.4-1ubuntu2.2+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | wget | 1.20.3-1ubuntu2.1+esm2 |
Vulnerabilities 5
-
Critical 9.1
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be ins…
-
High 7.5
GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containin…
-
Medium 5.9
GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character s…
-
Medium 5.9
GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding
GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large …
-
Medium 5.3
GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply mali…