CVE-2026-58469: GNU Wget Heap Buffer Underread in Metalink Processing

Technical summary

The vulnerability exists in the clean_metalink_string() function within src/metalink.c. This function is responsible for sanitizing whitespace from URLs extracted from Metalink XML documents. When processing a URL consisting entirely of whitespace, the function's pointer-decrement logic walks backward past the beginning of the allocated buffer, triggering a heap buffer underread (CWE-125). While the description indicates memory corruption occurs, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects denial-of-service impact rather than confidentiality or integrity compromise. The fix is available in commit 37a40fc of the Wget repository.

Business impact

This vulnerability primarily threatens availability. Organizations relying on Wget for automated downloads, mirrors, or continuous integration pipelines that consume Metalink files face potential service disruption if an attacker can inject a malicious Metalink response. The attack requires no authentication or user interaction, making it a concern for unattended automation. While memory corruption is involved, the assessed impact is crashing or hanging Wget processes rather than remote code execution, limiting but not eliminating operational risk.

Affected systems

GNU Wget versions up to and including 1.25.0 are affected. This includes default installations in many Linux distributions and BSD systems, as well as containers and embedded systems that include Wget for downloading resources. Any deployment using Wget's Metalink functionality (enabled by default with the --metalink flag or in scripts processing Metalink documents) is at risk. The vulnerability affects all supported architectures and operating systems where Wget runs.

Exploitability

Exploitation requires network-level capability to serve or intercept a Metalink response to a Wget client. The attack surface is relatively narrow—it only triggers when Wget processes Metalink documents, which is not always enabled by default in every context, though it is a standard feature. No authentication, special privileges, or user interaction is needed. An attacker could exploit this via DNS hijacking, man-in-the-middle attacks, or by compromising a legitimate mirror server. The technical bar for crafting the malicious payload is low—simply embedding whitespace-only URLs in valid Metalink XML.

Remediation

Apply the patch available in commit 37a40fc or upgrade to a patched release once distributions publish updates. Review deployment configurations to disable Metalink support if not actively used (--no-metalink flag or removal of metalink handling from scripts). For critical systems that cannot be immediately patched, consider network-level controls: restrict Wget to known, trusted mirror servers and monitor for unusual network patterns. Consider whether alternative download tools or pinned binary versions are feasible interim measures.

Patch guidance

Monitor official Wget project announcements and your distribution's security advisories for a patched release version. The fix is already committed to the Wget repository (commit 37a40fc); patched distributions should begin releasing updates within days to weeks of this advisory. Apply patches to all systems running affected Wget versions, prioritizing automation infrastructure, CI/CD systems, and build servers. Verify patch installation by checking the Wget version and testing against a locally controlled Metalink document containing whitespace URLs to confirm the crash no longer occurs.

Detection guidance

Monitor system logs and application outputs for Wget process crashes or abnormal terminations, particularly when triggered by network operations. Network intrusion detection can identify suspicious Metalink responses with malformed or whitespace-only URLs. Enable core dump analysis on systems where Wget may be targeted; examine crash dumps for heap corruption markers. In CI/CD environments, add process exit code monitoring and alerting. Audit Wget command-line arguments and configuration files to inventory which systems actually use Metalink; restrict that feature where unnecessary.

Why prioritize this

This vulnerability merits prompt patching due to its high CVSS score (7.5), low attack complexity, and prevalence of Wget in automation and infrastructure. While not in the CISA KEV catalog yet, the availability impact and broad deployment justify rapid remediation. Organizations with unattended download pipelines or mirror infrastructure should prioritize this above lower-severity issues. The primary concern is service disruption rather than data exfiltration, but the ease of exploitation and lack of required user interaction elevate risk.

Risk score, explained

The CVSS 7.5 HIGH score reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no authentication or user interaction required (PR:N/UI:N), and high availability impact (A:H). The absence of confidentiality or integrity impact (C:N/I:N) prevents a CRITICAL rating despite the memory corruption involved. The score appropriately weighs denial-of-service risk in a widely deployed utility without requiring the attacker to gain system access or trick users.

Frequently asked questions