CVE-2026-16599: CWE-606 Unchecked input for loop condition in GNU wget

CVE-2026-16599 is a denial of service vulnerability in GNU wget's FTP OPIE/S-KEY authentication mechanism. The vulnerability is due to unchecked input for the loop condition where the server-supplied sequence number from the FTP challenge line is used as the iteration count for an MD5 key-derivation loop without any upper bound validation. An attacker controlling the FTP server or able to intercept FTP traffic can supply a crafted challenge with a sequence number near INT_MAX, causing wget to perform approximately 2.1 billion MD5 computations, leading to a suspension of the wget process. The --timeout option does not mitigate this because it only applies to network I/O, not CPU-bound operations. The vulnerability was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.

An attacker can cause wget to consume excessive CPU resources by sending a crafted FTP OPIE challenge with a very large sequence number. This results in a denial of service by suspending wget for an extended period. The vulnerability does not allow code execution or data compromise but impacts availability of the wget process during exploitation.

A fix is available and was implemented in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa. Users should update wget to a version that includes this fix. The --timeout option does not mitigate this vulnerability. Until patched, avoid using wget with untrusted FTP servers that support OPIE/S-KEY authentication.