Threats Tagged 'cve-2026-58470'

Multiple security vulnerabilities have been fixed in wget, including server-side request forgery via unvalidated FTP PASV response IP addresses, heap buffer underread from Metalink documents with whitespace-only URLs, integer overflow from server-controlled Content-Range headers, heap memory corruption from character set conversion of server-supplied filenames, and heap buffer overflow from crafted HTML attributes requiring entity encoding. Additional bug fixes address segmentation faults and regressions related to Metalink processing.

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.