# CVE-2026-58469: GNU Wget heap buffer underread in clean_metalink_string

Source: https://junglewise.ai/threats/cve-2026-58469-gnu-wget-heap-buffer-underread-in-clean-metalink-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-58469 · Severity: high · CVSS 7.5 · Published 2026-07-07

GNU Wget is a widely used command-line tool for downloading files from the internet. A vulnerability in how it handles certain download metadata files (Metalink) allows a malicious server to crash the application or cause unpredictable behavior. This could disrupt automated download scripts or services that rely on Wget to fetch external content.

Technologies: [Gnu Wget](https://junglewise.ai/threats/technologies/wget). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-58469 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58469 being exploited in the wild.

**How severe is CVE-2026-58469?** High severity, with a CVSS score of 7.5, published 7 July 2026.

**Which products and versions are affected?** Gnu Wget through 1.25.0.

**Is there a fix for CVE-2026-58469?** A patch was published on 2026-06-29: Fix committed to upstream repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58469 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58469?** Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer underread exists in the clean_metalink_string() function within src/metalink.c of GNU Wget. The vulnerability is triggered when the application processes a Metalink document containing a URL composed entirely of whitespace characters. In this scenario, the function fails to properly validate the buffer boundaries while trimming whitespace, causing it to decrement a pointer past the start of the allocated memory. This results in an out-of-bounds read (CWE-125) that can lead to memory corruption and application crashes (denial of service). The issue is fixed in Git commit 37a40fc.

## Affected products

- GNU Wget through 1.25.0

## Timeline

- 2026-06-29: patched: Fix committed to upstream repository.
- 2026-07-07: disclosed: CVE published and NVD entry created.

## References

- [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826](https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826)
- [https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalink-url-parsing](https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalink-url-parsing)

## Related threats

- [GNU wget local code execution via hardcoded config path](https://junglewise.ai/threats/cve-2026-94574-a-local-cross-user-code-execution-vulnerability-exists-in-gnu)
- [GNU wget denial of service in FTP OPIE/S-KEY authentication](https://junglewise.ai/threats/cve-2026-16599-gnu-wget-denial-of-service-in-ftp-opie-s-key-authentication)
- [GNU Wget SSRF via unvalidated FTP PASV IP address](https://junglewise.ai/threats/cve-2026-15146-gnu-wget-ssrf-via-unvalidated-ftp-pasv-ip-address)
- [GNU Wget integer overflow in parse_content_range](https://junglewise.ai/threats/cve-2026-58470-gnu-wget-integer-overflow-in-parse-content-range)