p PatchFirst

CVE-2026-58469

CVE-2026-58469 · GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wget

    Versions
    • ≥ 0, ≤ 1.25.0: Affected (semver)
    • 37a40fcb450153f69537c7cbc2a7a4fb0b6f7826: Not affected (git)

    No fix published

  • wget Debian:12

    Versions
    • 1.21.3-1
    • 1.21.3-1+deb12u1
    • 1.21.4-1
    • 1.24.5-1
    • 1.24.5-2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:13

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:14

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:18.04:LTS

    Versions
    • 1.19.1-3ubuntu1
    • 1.19.1-3ubuntu1.1
    • 1.19.2-1ubuntu1
    • 1.19.3-2ubuntu1
    • 1.19.4-1ubuntu2
    • 1.19.4-1ubuntu2.1
    • 1.19.4-1ubuntu2.2
    • 1.19.4-1ubuntu2.2+esm1
    Affected ranges
    • ECOSYSTEM: < 1.19.4-1ubuntu2.2+esm3

    Update to 1.19.4-1ubuntu2.2+esm3

  • wget Ubuntu:Pro:20.04:LTS

    Versions
    • 1.20.3-1ubuntu1
    • 1.20.3-1ubuntu2
    • 1.20.3-1ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu2.1+esm2

    Update to 1.20.3-1ubuntu2.1+esm2

  • wget Ubuntu:22.04:LTS

    Versions
    • 1.21-1ubuntu3
    • 1.21-1ubuntu4
    • 1.21-1ubuntu5
    • 1.21.2-2ubuntu1
    • 1.21.2-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.21.2-2ubuntu1.3

    Update to 1.21.2-2ubuntu1.3

  • wget Ubuntu:24.04:LTS

    Versions
    • 1.21.3-1ubuntu1
    • 1.21.4-1ubuntu1
    • 1.21.4-1ubuntu2
    • 1.21.4-1ubuntu3
    • 1.21.4-1ubuntu4
    • 1.21.4-1ubuntu4.1
    Affected ranges
    • ECOSYSTEM: < 1.21.4-1ubuntu4.3

    Update to 1.21.4-1ubuntu4.3

  • wget Ubuntu:25.10

    Versions
    • 1.24.5-2ubuntu1
    • 1.25.0-2ubuntu1
    • 1.25.0-2ubuntu2
    • 1.25.0-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:26.04:LTS

    Versions
    • 1.25.0-2ubuntu3
    • 1.25.0-2ubuntu4
    Affected ranges
    • ECOSYSTEM: < 1.25.0-2ubuntu4.2

    Update to 1.25.0-2ubuntu4.2

Original sources

Check your server →