Skip to content
OpenAdvisories
High · 7.6 CVE-2025-69195 EUVD-2026-1777GHSA-q2gj-jpwc-8f46

Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls

Published Jan 9, 2026 · Updated Feb 26, 2026 · Assigned by fedora

Description

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.

Affected products

VendorProductAffectedFixed
— wget2 2.1.0 – ≤ 2.2.0 2.2.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wget2 2.2.0+ds-3 —
Debian 13 wget2 2.2.0+ds-1+deb13u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wget2 No fix yet —
Ubuntu 26.04 LTS wget2 No fix yet —
Ubuntu 25.10 wget2 No fix yet —
Ubuntu 24.04 LTS wget2 No fix yet —
Ubuntu 22.04 LTS wget2 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wget2 No fix yet —
Ubuntu 18.04 LTS wget2 No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed wget2 2.2.1-1.1 openSUSE-SU-2026:10015-1
openSUSE Leap 16.0 wget2 2.2.1-bp160.1.1 openSUSE-SU-2026:20038-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 wget 2.1.0-7 —

Advisories 3

References