Is CVE-2026-16599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16599 being exploited in the wild.

How severe is CVE-2026-16599?

Informational severity, published 25 August 2026.

Is there a fix for CVE-2026-16599?

A patch was published on 2026-08-25: Fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16599 attacked?

It is attacked over the network.

Am I affected by CVE-2026-16599?

Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16599: GNU wget denial of service in FTP OPIE/S-KEY authentication

CVE-2026-16599 · Severity: info · Published 2026-08-25

GNU wget is a command-line tool used to download files from the internet over various protocols including FTP. A malicious FTP server or network attacker can send a specially crafted FTP authentication challenge that forces wget to perform billions of MD5 calculations, causing the application to freeze and become unresponsive for an extended period. This denial of service attack cannot be mitigated by wget's timeout settings.

Technologies: Gnu Wget. Vendors: Gnu.

Quick answers

Is CVE-2026-16599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16599 being exploited in the wild.
How severe is CVE-2026-16599?: Informational severity, published 25 August 2026.
Which products and versions are affected?: Gnu Wget through 1.25.0.
Is there a fix for CVE-2026-16599?: A patch was published on 2026-08-25: Fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16599 attacked?: It is attacked over the network.
Am I affected by CVE-2026-16599?: Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in wget's FTP OPIE/S-KEY authentication handler, where the server-supplied sequence number from the FTP challenge line is used directly as an iteration count for an MD5 key-derivation loop without any upper bound validation (CWE-606). An attacker controlling an FTP server or positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number close to INT_MAX (approximately 2.1 billion), causing wget to perform an enormous number of MD5 computations. This results in CPU exhaustion and application suspension. The attack requires network access to FTP traffic and does not require authentication. The vulnerability was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.

Affected products

GNU wget through 1.25.0

Timeline

2026-08-25: disclosed
2026-08-25: patched: Fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.