Read the docs
TI-2026-42076 Aliases CVE-2026-58472GHSA-332r-8pmf-8m9p

GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

Priority LOW 27CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-08
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUwgetup to 1.25.0—Patch availableCNA
  • wget VendorGNU Affected up to 1.25.0 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*up to 1.25.0VulnerableGNU
  • cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:* Versions up to 1.25.0 Vulnerable ·GNU

Remediation

Red Hat 3 advisories

  • RHSA-2026:62144 Released 2026-09-01 · Red Hat rating Moderate
    wget security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) wget-1.19.5-16.el8_10
  • RHSA-2026:62143 Released 2026-09-01 · Red Hat rating Moderate
    wget security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) wget-1.21.1-11.el9_8
  • RHSA-2026:62142 Released 2026-09-01 · Red Hat rating Moderate
    wget security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) wget-1.24.5-8.el10_2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:62142
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:62144
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:62143

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58472
  2. 2026-10-03 Alias added: GHSA-332r-8pmf-8m9p

References

Patch 1

  • TI-2017-09727 GNU Wget: stack overflow in HTTP protocol handling CVSS 3.0HIGH 8.8
  • TI-2016-04293 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… CVSS 3.1HIGH 8.8
  • TI-2014-04014 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… CVSS 2.0HIGH 9.3
  • TI-2017-09728 GNU Wget: heap overflow in HTTP protocol handling CVSS 3.0HIGH 8.8
  • TI-2019-04244 Out-of-bounds write in GNU Wget CVSS 3.0CRITICAL 9.8
  • TI-2016-06103 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to… CVSS 3.0HIGH 8.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences