CVE-2026-16599: Denial of Service in GNU wget
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INTMAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU wgetto a version that resolves this vulnerability.Patch e9697d98e7249b0f68a6be040a4f3dcc5bc101fa - Compensating control
Mitigate exposure by avoiding FTP connections to untrusted networks/servers; prevent network interception of FTP traffic (e.g., enforce use of secure transport or isolate/ACL the FTP network path) since a malicious/positioned attacker can send crafted FTP OPIE challenge lines.
Event History
Frequently Asked Questions
Who is exposed to this denial of service?
Clients that use GNU Wget to connect to FTP servers using FTP OPIE/S-KEY authentication are exposed. Exploitation requires either a malicious FTP server or an attacker able to intercept and alter FTP traffic.
Does setting --timeout prevent the resource exhaustion?
No. The timeout applies to network I/O only and does not limit the CPU time spent in the MD5 key-derivation loop.
What can be done if the fix cannot be applied immediately?
Avoid using FTP OPIE/S-KEY authentication with untrusted FTP servers and avoid FTP connections where traffic can be intercepted or modified. This reduces the opportunity for an attacker to supply a crafted challenge.
How can I determine whether my Wget build contains the fix?
Check whether the build includes commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.