Vulnerability-Lookup

RHSA-2026:62142

Vulnerability from csaf_redhat - Published: 2026-09-01 16:03 - Updated: 2026-09-01 20:03

Summary

Red Hat Security Advisory: wget security, bug fix, and enhancement update

Severity

Moderate

Notes

Topic: An update for wget is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471) * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472) Bug Fix(es) and Enhancement(s): * wget async unsafe code in signal handler context [rhel-10.2.z] (JIRA:RHEL-220498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-58471

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the convert_fname() function. This occurs when processing a server-supplied filename that requires character set conversion, leading to memory corruption due to incorrect buffer reallocation. This can result in a denial of service or other impacts.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-58472

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the `html_quote_string()` function by providing a specially crafted HTML attribute. This can lead to memory corruption and potentially result in arbitrary code execution or a denial of service.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

17 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:62142	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2497850	external
https://bugzilla.redhat.com/show_bug.cgi?id=2497857	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-58471	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497850	external
https://www.cve.org/CVERecord?id=CVE-2026-58471	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58471	external
https://gitlab.com/gnuwget/wget/-/commit/c2640fe5…	external
https://www.vulncheck.com/advisories/gnu-wget-hea…	external
https://access.redhat.com/security/cve/CVE-2026-58472	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497857	external
https://www.cve.org/CVERecord?id=CVE-2026-58472	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58472	external
https://gitlab.com/gnuwget/wget/-/commit/dd692d9c…	external
https://www.vulncheck.com/advisories/gnu-wget-hea…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for wget is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.\n\nSecurity Fix(es):\n\n* wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471)\n\n* wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472)\n\nBug Fix(es) and Enhancement(s):\n\n* wget async unsafe code in signal handler context [rhel-10.2.z] (JIRA:RHEL-220498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:62142",
        "url": "https://access.redhat.com/errata/RHSA-2026:62142"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2497850",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497850"
      },
      {
        "category": "external",
        "summary": "2497857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497857"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62142.json"
      }
    ],
    "title": "Red Hat Security Advisory: wget security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-01T20:03:05+00:00",
      "generator": {
        "date": "2026-09-01T20:03:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:62142",
      "initial_release_date": "2026-09-01T16:03:19+00:00",
      "revision_history": [
        {
          "date": "2026-09-01T16:03:19+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-01T16:03:19+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T20:03:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.24.5-8.el10_2.src",
                "product": {
                  "name": "wget-0:1.24.5-8.el10_2.src",
                  "product_id": "wget-0:1.24.5-8.el10_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.24.5-8.el10_2.aarch64",
                "product": {
                  "name": "wget-0:1.24.5-8.el10_2.aarch64",
                  "product_id": "wget-0:1.24.5-8.el10_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debugsource-0:1.24.5-8.el10_2.aarch64",
                "product": {
                  "name": "wget-debugsource-0:1.24.5-8.el10_2.aarch64",
                  "product_id": "wget-debugsource-0:1.24.5-8.el10_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debugsource@1.24.5-8.el10_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
                "product": {
                  "name": "wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
                  "product_id": "wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.24.5-8.el10_2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.24.5-8.el10_2.ppc64le",
                "product": {
                  "name": "wget-0:1.24.5-8.el10_2.ppc64le",
                  "product_id": "wget-0:1.24.5-8.el10_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
                "product": {
                  "name": "wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
                  "product_id": "wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debugsource@1.24.5-8.el10_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
                "product": {
                  "name": "wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
                  "product_id": "wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.24.5-8.el10_2?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.24.5-8.el10_2.s390x",
                "product": {
                  "name": "wget-0:1.24.5-8.el10_2.s390x",
                  "product_id": "wget-0:1.24.5-8.el10_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debugsource-0:1.24.5-8.el10_2.s390x",
                "product": {
                  "name": "wget-debugsource-0:1.24.5-8.el10_2.s390x",
                  "product_id": "wget-debugsource-0:1.24.5-8.el10_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debugsource@1.24.5-8.el10_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.24.5-8.el10_2.s390x",
                "product": {
                  "name": "wget-debuginfo-0:1.24.5-8.el10_2.s390x",
                  "product_id": "wget-debuginfo-0:1.24.5-8.el10_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.24.5-8.el10_2?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.24.5-8.el10_2.x86_64",
                "product": {
                  "name": "wget-0:1.24.5-8.el10_2.x86_64",
                  "product_id": "wget-0:1.24.5-8.el10_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.24.5-8.el10_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debugsource-0:1.24.5-8.el10_2.x86_64",
                "product": {
                  "name": "wget-debugsource-0:1.24.5-8.el10_2.x86_64",
                  "product_id": "wget-debugsource-0:1.24.5-8.el10_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debugsource@1.24.5-8.el10_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
                "product": {
                  "name": "wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
                  "product_id": "wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.24.5-8.el10_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.24.5-8.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64"
        },
        "product_reference": "wget-0:1.24.5-8.el10_2.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.24.5-8.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le"
        },
        "product_reference": "wget-0:1.24.5-8.el10_2.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.24.5-8.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x"
        },
        "product_reference": "wget-0:1.24.5-8.el10_2.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.24.5-8.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src"
        },
        "product_reference": "wget-0:1.24.5-8.el10_2.src",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.24.5-8.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64"
        },
        "product_reference": "wget-0:1.24.5-8.el10_2.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.24.5-8.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64"
        },
        "product_reference": "wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.24.5-8.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le"
        },
        "product_reference": "wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.24.5-8.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x"
        },
        "product_reference": "wget-debuginfo-0:1.24.5-8.el10_2.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.24.5-8.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64"
        },
        "product_reference": "wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debugsource-0:1.24.5-8.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64"
        },
        "product_reference": "wget-debugsource-0:1.24.5-8.el10_2.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debugsource-0:1.24.5-8.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le"
        },
        "product_reference": "wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debugsource-0:1.24.5-8.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x"
        },
        "product_reference": "wget-debugsource-0:1.24.5-8.el10_2.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debugsource-0:1.24.5-8.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
        },
        "product_reference": "wget-debugsource-0:1.24.5-8.el10_2.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-58471",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-07-07T21:02:05.254478+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497850"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the convert_fname() function. This occurs when processing a server-supplied filename that requires character set conversion, leading to memory corruption due to incorrect buffer reallocation. This can result in a denial of service or other impacts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A heap buffer overflow in GNU Wget, affecting Red Hat Enterprise Linux and other products, can be triggered by a remote attacker. This flaw occurs when `wget` processes a specially crafted server-supplied filename that requires character set conversion, leading to memory corruption. Successful exploitation requires user interaction with a malicious server and could result in a denial of service or potentially other impacts.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497850",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497850"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58471"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee",
          "url": "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c",
          "url": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c"
        }
      ],
      "release_date": "2026-07-07T19:47:47.662000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T16:03:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62142"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, always use the -O (or --output-document) flag in your scripts to explicitly define the local filename. This forces wget to ignore the server\u0027s provided filename, completely bypassing the vulnerable code path.",
          "product_ids": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption"
    },
    {
      "cve": "CVE-2026-58472",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-07-07T21:02:21.861219+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the `html_quote_string()` function by providing a specially crafted HTML attribute. This can lead to memory corruption and potentially result in arbitrary code execution or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact heap buffer overflow in GNU Wget occurs when processing HTML attributes with extensive entity encoding. Successful exploitation requires user interaction, as a victim must download a specially crafted HTML file, and is further constrained by high attack complexity. This limits the direct risk to Red Hat systems where Wget is typically used for trusted content retrieval.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
          "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
          "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58472"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58472",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58472"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58472",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58472"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812",
          "url": "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-attribute-encoding",
          "url": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-attribute-encoding"
        }
      ],
      "release_date": "2026-07-07T19:50:53.967000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T16:03:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62142"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid retrieving content from untrusted or unverified sources using Wget.",
          "product_ids": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.src",
            "AppStream-10.2.Z:wget-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debuginfo-0:1.24.5-8.el10_2.x86_64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.aarch64",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.ppc64le",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.s390x",
            "AppStream-10.2.Z:wget-debugsource-0:1.24.5-8.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute"
    }
  ]
}

CVE-2026-58471 (GCVE-0-2026-58471)

Vulnerability from cvelistv5 – Published: 2026-07-07 19:47 – Updated: 2026-07-14 22:03 X_Open Source

Title

GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c

Summary

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-07 20:32 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://gitlab.com/gnuwget/wget/-/commit/c2640fe5…	patch
https://www.vulncheck.com/advisories/gnu-wget-hea…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gnuwget	wget	Affected: 0 , ≤ 1.25.0 (semver) Unaffected: c2640fe5171c59f87c58dc9fcb195b2d18b010ee (git) cpe:2.3:a:gnu:wget::::::::

Date Public

2026-01-13 00:00

Credits

Tristan Madani Arkadi Vainbrand

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T20:32:14.930000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T20:32:25.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "wget",
          "repo": "https://gitlab.com/gnuwget/wget",
          "vendor": "gnuwget",
          "versions": [
            {
              "lessThanOrEqual": "1.25.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "c2640fe5171c59f87c58dc9fcb195b2d18b010ee",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.25.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Arkadi Vainbrand"
        }
      ],
      "datePublic": "2026-01-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:03:12.273Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Fix Commit",
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58471",
    "datePublished": "2026-07-07T19:47:47.662Z",
    "dateReserved": "2026-06-30T20:20:33.790Z",
    "dateUpdated": "2026-07-14T22:03:12.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58472 (GCVE-0-2026-58472)

Vulnerability from cvelistv5 – Published: 2026-07-07 19:50 – Updated: 2026-07-14 22:03 X_Open Source

Title

GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

Summary

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 13:45 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://gitlab.com/gnuwget/wget/-/commit/dd692d9c…	patch
https://www.vulncheck.com/advisories/gnu-wget-hea…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gnuwget	wget	Affected: 0 , ≤ 1.25.0 (semver) Unaffected: dd692d9cea5335b181d877ae917fe6e75587a812 (git) cpe:2.3:a:gnu:wget::::::::

Date Public

2026-06-29 00:00

Credits

Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58472",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:45:48.507469Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T13:45:59.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "wget",
          "repo": "https://gitlab.com/gnuwget/wget",
          "vendor": "gnuwget",
          "versions": [
            {
              "lessThanOrEqual": "1.25.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "dd692d9cea5335b181d877ae917fe6e75587a812",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.25.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        }
      ],
      "datePublic": "2026-06-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:03:12.957Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Fix Commit",
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-attribute-encoding"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58472",
    "datePublished": "2026-07-07T19:50:53.967Z",
    "dateReserved": "2026-06-30T20:20:33.790Z",
    "dateUpdated": "2026-07-14T22:03:12.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:62142

CVE-2026-58471 (GCVE-0-2026-58471)

CVE-2026-58472 (GCVE-0-2026-58472)

Tags

Sightings

Nomenclature