p PatchFirst

CVE-2026-58472

CVE-2026-58472 · GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

CVSS 6.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wget

    Versions
    • ≥ 0, ≤ 1.25.0: Affected (semver)
    • dd692d9cea5335b181d877ae917fe6e75587a812: Not affected (git)

    No fix published

  • wget Debian:12

    Versions
    • 1.21.3-1
    • 1.21.3-1+deb12u1
    • 1.21.4-1
    • 1.24.5-1
    • 1.24.5-2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:13

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:14

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:Pro:14.04:LTS

    Versions
    • 1.14-2ubuntu1
    • 1.14-5ubuntu1
    • 1.15-1ubuntu1
    • 1.15-1ubuntu1.14.04.1
    • 1.15-1ubuntu1.14.04.2
    • 1.15-1ubuntu1.14.04.3
    • 1.15-1ubuntu1.14.04.4
    • 1.15-1ubuntu1.14.04.5
    Affected ranges
    • ECOSYSTEM: < 1.15-1ubuntu1.14.04.5+esm2

    Update to 1.15-1ubuntu1.14.04.5+esm2

  • wget Ubuntu:Pro:16.04:LTS

    Versions
    • 1.16.1-1ubuntu1
    • 1.17.1-1ubuntu1
    • 1.17.1-1ubuntu1.1
    • 1.17.1-1ubuntu1.2
    • 1.17.1-1ubuntu1.3
    • 1.17.1-1ubuntu1.4
    • 1.17.1-1ubuntu1.5
    • 1.17.1-1ubuntu1.5+esm1
    Affected ranges
    • ECOSYSTEM: < 1.17.1-1ubuntu1.5+esm3

    Update to 1.17.1-1ubuntu1.5+esm3

  • wget Ubuntu:Pro:18.04:LTS

    Versions
    • 1.19.1-3ubuntu1
    • 1.19.1-3ubuntu1.1
    • 1.19.2-1ubuntu1
    • 1.19.3-2ubuntu1
    • 1.19.4-1ubuntu2
    • 1.19.4-1ubuntu2.1
    • 1.19.4-1ubuntu2.2
    • 1.19.4-1ubuntu2.2+esm1
    Affected ranges
    • ECOSYSTEM: < 1.19.4-1ubuntu2.2+esm3

    Update to 1.19.4-1ubuntu2.2+esm3

  • wget Ubuntu:Pro:20.04:LTS

    Versions
    • 1.20.3-1ubuntu1
    • 1.20.3-1ubuntu2
    • 1.20.3-1ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu2.1+esm2

    Update to 1.20.3-1ubuntu2.1+esm2

  • wget Ubuntu:22.04:LTS

    Versions
    • 1.21-1ubuntu3
    • 1.21-1ubuntu4
    • 1.21-1ubuntu5
    • 1.21.2-2ubuntu1
    • 1.21.2-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.21.2-2ubuntu1.3

    Update to 1.21.2-2ubuntu1.3

  • wget Ubuntu:24.04:LTS

    Versions
    • 1.21.3-1ubuntu1
    • 1.21.4-1ubuntu1
    • 1.21.4-1ubuntu2
    • 1.21.4-1ubuntu3
    • 1.21.4-1ubuntu4
    • 1.21.4-1ubuntu4.1
    Affected ranges
    • ECOSYSTEM: < 1.21.4-1ubuntu4.3

    Update to 1.21.4-1ubuntu4.3

  • wget Ubuntu:25.10

    Versions
    • 1.24.5-2ubuntu1
    • 1.25.0-2ubuntu1
    • 1.25.0-2ubuntu2
    • 1.25.0-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Ubuntu:26.04:LTS

    Versions
    • 1.25.0-2ubuntu3
    • 1.25.0-2ubuntu4
    Affected ranges
    • ECOSYSTEM: < 1.25.0-2ubuntu4.2

    Update to 1.25.0-2ubuntu4.2

Original sources

Check your server →