CVE-2026-58469: GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Fixed in 1.25.0Patch 37a40fc - Compensating control
Mitigate exposure by blocking or filtering Metalink URLs from untrusted/malicious servers until the fix (commit 37a40fc) is applied to GNU Wget.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58469?
CVE-2026-58469 has a high severity rating of 7.5.
How do I fix CVE-2026-58469?
To fix CVE-2026-58469, update GNU Wget to a version later than 1.25.0, as the vulnerability has been addressed in a recent commit.
What type of vulnerability is CVE-2026-58469?
CVE-2026-58469 is a heap buffer underread vulnerability that can lead to memory corruption.
What causes the vulnerability in CVE-2026-58469?
The vulnerability in CVE-2026-58469 is caused by improper handling of whitespace-only URLs within Metalink documents.
Who is affected by CVE-2026-58469?
Users of GNU Wget version 1.25.0 and prior are at risk of CVE-2026-58469.