CVE-2026-58470: GNU Wget Integer Overflow in Content-Range Parsing – Patch & Detection Guide

Technical summary

The vulnerability is an integer overflow (CWE-190) in the parse_content_range() function within src/http.c of GNU Wget. When processing a Content-Range header, the function performs signed integer arithmetic on server-supplied values without adequate bounds checking. An attacker can supply values that cause this arithmetic to overflow, triggering undefined behavior. The resulting state mismatch corrupts the internal download state machine, leading to desynchronization between the client's expected and actual byte offsets. This allows an attacker to cause denial of service through malformed download sessions.

Business impact

Organizations relying on Wget for automated downloads—such as deployment scripts, CI/CD pipelines, or system administration tasks—face potential disruption. A compromised or attacker-controlled server can cause download failures or corruption, breaking automated workflows or delivering corrupted files. While the vulnerability does not enable code execution or information disclosure, the availability impact could affect build systems, package distribution, or backup automation if not mitigated promptly.

Affected systems

GNU Wget versions up to and including 1.25.0 are affected. The vulnerability does not require special build flags or configurations; any system using the standard Wget binary to fetch files from untrusted or attacker-controlled HTTP servers is at risk. Systems performing automated downloads (e.g., Linux package managers using Wget as a backend, embedded systems, container image builds) should be prioritized for patching.

Exploitability

Exploitation requires network access and the ability to control or intercept HTTP responses (either via MITM, DNS hijacking, or by hosting a malicious server). No user interaction or special conditions are required beyond initiating a download from the attacker's server. The attack surface is broad because Wget is commonly used non-interactively in scripts; however, real-world attacks depend on an attacker's ability to position themselves in the network path or trick a user/system into downloading from their server.

Remediation

Update GNU Wget to a patched version that includes commit 43d3ba9 or later. For systems still running vulnerable versions, implement network-layer protections: restrict outbound HTTP/HTTPS to trusted servers, use TLS certificate pinning for critical downloads, validate file integrity post-download (e.g., via checksums), and monitor for anomalous download behavior in logs.

Patch guidance

Consult the GNU Wget project's official release notes and advisories to identify the first patched version containing commit 43d3ba9. Verify the specific version number against your vendor's advisory or the upstream repository. Most Linux distributions will issue security updates; check your distribution's security bulletin for the patched Wget package version and apply it via your package manager (apt, yum, pacman, etc.). For custom or bundled Wget installations, rebuild from source with the patched commit.

Detection guidance

Monitor HTTP access logs for unusual Content-Range header patterns (especially those with unusually large or negative byte offsets). Inspect Wget process behavior for repeated connection drops or incomplete downloads from specific servers. Implement file integrity checks (hash verification) as a post-download control to detect corrupted files before use. Log and alert on parse errors or unexpected terminations in Wget command output, particularly in automated deployment pipelines.

Why prioritize this

While rated MEDIUM severity due to limited impact scope (availability only, no confidentiality or integrity breach of downloaded data), the vulnerability should be patched promptly because Wget is ubiquitous in infrastructure automation. Exploitation is straightforward given network access, and the impact on CI/CD and deployment systems could be significant. Prioritize systems performing critical downloads; lower-priority targets can follow in standard patching cycles.

Risk score, explained

The CVSS v3.1 score of 5.3 (MEDIUM) reflects an attack vector requiring network access but no privileges or user interaction, with low attack complexity. The impact is limited to availability (malformed downloads, connection resets) with no effect on confidentiality or integrity of data in transit. The score appropriately reflects that while the bug is easily triggered by a network attacker, the harm is bounded to denial of service via download disruption rather than data theft or remote code execution.

Frequently asked questions