p PatchFirst

CVE-2026-58470

CVE-2026-58470 · GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wget

    Versions
    • ≥ 0, ≤ 1.25.0: Affected (semver)
    • 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf: Not affected (git)

    No fix published

  • wget Debian:12

    Versions
    • 1.21.3-1
    • 1.21.3-1+deb12u1
    • 1.21.4-1
    • 1.24.5-1
    • 1.24.5-2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:13

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:14

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:14.04:LTS

    Versions
    • 1.14-2ubuntu1
    • 1.14-5ubuntu1
    • 1.15-1ubuntu1
    • 1.15-1ubuntu1.14.04.1
    • 1.15-1ubuntu1.14.04.2
    • 1.15-1ubuntu1.14.04.3
    • 1.15-1ubuntu1.14.04.4
    • 1.15-1ubuntu1.14.04.5
    Affected ranges
    • ECOSYSTEM: < 1.15-1ubuntu1.14.04.5+esm2

    Update to 1.15-1ubuntu1.14.04.5+esm2

  • wget Ubuntu:Pro:16.04:LTS

    Versions
    • 1.16.1-1ubuntu1
    • 1.17.1-1ubuntu1
    • 1.17.1-1ubuntu1.1
    • 1.17.1-1ubuntu1.2
    • 1.17.1-1ubuntu1.3
    • 1.17.1-1ubuntu1.4
    • 1.17.1-1ubuntu1.5
    • 1.17.1-1ubuntu1.5+esm1
    Affected ranges
    • ECOSYSTEM: < 1.17.1-1ubuntu1.5+esm3

    Update to 1.17.1-1ubuntu1.5+esm3

  • wget Ubuntu:Pro:18.04:LTS

    Versions
    • 1.19.1-3ubuntu1
    • 1.19.1-3ubuntu1.1
    • 1.19.2-1ubuntu1
    • 1.19.3-2ubuntu1
    • 1.19.4-1ubuntu2
    • 1.19.4-1ubuntu2.1
    • 1.19.4-1ubuntu2.2
    • 1.19.4-1ubuntu2.2+esm1
    Affected ranges
    • ECOSYSTEM: < 1.19.4-1ubuntu2.2+esm3

    Update to 1.19.4-1ubuntu2.2+esm3

  • wget Ubuntu:Pro:20.04:LTS

    Versions
    • 1.20.3-1ubuntu1
    • 1.20.3-1ubuntu2
    • 1.20.3-1ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu2.1+esm2

    Update to 1.20.3-1ubuntu2.1+esm2

  • wget Ubuntu:22.04:LTS

    Versions
    • 1.21-1ubuntu3
    • 1.21-1ubuntu4
    • 1.21-1ubuntu5
    • 1.21.2-2ubuntu1
    • 1.21.2-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.21.2-2ubuntu1.3

    Update to 1.21.2-2ubuntu1.3

  • wget Ubuntu:24.04:LTS

    Versions
    • 1.21.3-1ubuntu1
    • 1.21.4-1ubuntu1
    • 1.21.4-1ubuntu2
    • 1.21.4-1ubuntu3
    • 1.21.4-1ubuntu4
    • 1.21.4-1ubuntu4.1
    Affected ranges
    • ECOSYSTEM: < 1.21.4-1ubuntu4.3

    Update to 1.21.4-1ubuntu4.3

  • wget Ubuntu:25.10

    Versions
    • 1.24.5-2ubuntu1
    • 1.25.0-2ubuntu1
    • 1.25.0-2ubuntu2
    • 1.25.0-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:26.04:LTS

    Versions
    • 1.25.0-2ubuntu3
    • 1.25.0-2ubuntu4
    Affected ranges
    • ECOSYSTEM: < 1.25.0-2ubuntu4.2

    Update to 1.25.0-2ubuntu4.2

Original sources

Check your server →