The vulnerability in GNU wget2 involves improper input validation (CWE-20) of server certificates during TLS authentication. wget2 does not correctly verify that the Key Usage and Extended Key Usage fields in a server certificate are appropriate for TLS server authentication. Consequently, an attacker who has access to a certificate and private key intended for a different use could exploit this weakness to impersonate a TLS server. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits in the wild have been reported.

If exploited, this vulnerability could allow an attacker to reuse a compromised certificate (with private key) issued for a different purpose to authenticate as a legitimate TLS server to wget2 clients. This could lead to partial compromise of confidentiality and integrity of data transmitted over TLS connections established by wget2. However, the attack complexity is high and no known exploits exist currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using wget2 to connect to untrusted servers and consider additional TLS verification methods outside of wget2. Monitor official GNU wget2 channels for updates or patches addressing this issue.