REDHAT-BUG-2497857: Buffer Overflow

Q: Which releases are affected and what fixes the issue?

GNU Wget through version 1.25.0 is affected. The issue is fixed in commit dd692d9.

Q: What does an attacker need to control to trigger the flaw?

An attacker needs to supply HTML containing an attribute with a large number of characters that require entity encoding. The vulnerable processing occurs when Wget handles that server-supplied attribute.

Published Jul 7, 2026

Updated

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

Affected Software

1 affected component

GNU Wget<=1.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GNU Wget to a version that resolves this vulnerability.
Fixed in 1.25.0Patch dd692d9

Event History

Jul 7, 2026

Data Sourced

via Red Hat·09:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which releases are affected and what fixes the issue?

GNU Wget through version 1.25.0 is affected. The issue is fixed in commit dd692d9.

What does an attacker need to control to trigger the flaw?

An attacker needs to supply HTML containing an attribute with a large number of characters that require entity encoding. The vulnerable processing occurs when Wget handles that server-supplied attribute.