Executive brief
GNU wget is a command-line tool used to download files from the internet over various protocols including FTP. A malicious FTP server or network attacker can send a specially crafted FTP authentication challenge that forces wget to perform billions of MD5 calculations, causing the application to freeze and become unresponsive for an extended period. This denial of service attack cannot be mitigated by wget's timeout settings.
Technical details
The vulnerability exists in wget's FTP OPIE/S-KEY authentication handler, where the server-supplied sequence number from the FTP challenge line is used directly as an iteration count for an MD5 key-derivation loop without any upper bound validation (CWE-606). An attacker controlling an FTP server or positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number close to INT_MAX (approximately 2.1 billion), causing wget to perform an enormous number of MD5 computations. This results in CPU exhaustion and application suspension. The attack requires network access to FTP traffic and does not require authentication. The vulnerability was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.
Affected products
- GNU wget through 1.25.0
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa