Executive brief
GNU Wget is a widely used command-line tool for downloading files from the internet. A vulnerability in how it handles certain download metadata files (Metalink) allows a malicious server to crash the application or cause unpredictable behavior. This could disrupt automated download scripts or services that rely on Wget to fetch external content.
Technical details
A heap buffer underread exists in the clean_metalink_string() function within src/metalink.c of GNU Wget. The vulnerability is triggered when the application processes a Metalink document containing a URL composed entirely of whitespace characters. In this scenario, the function fails to properly validate the buffer boundaries while trimming whitespace, causing it to decrement a pointer past the start of the allocated memory. This results in an out-of-bounds read (CWE-125) that can lead to memory corruption and application crashes (denial of service). The issue is fixed in Git commit 37a40fc.
Affected products
- GNU Wget through 1.25.0
Timeline
- 2026-06-29: patched: Fix committed to upstream repository.
- 2026-07-07: disclosed: CVE published and NVD entry created.