Executive brief
GNU Wget is a widely used command-line tool for downloading files from the internet. A vulnerability in how it processes server responses could allow a malicious web server to cause the tool to crash or behave unpredictably. This could disrupt automated data collection processes or lead to incomplete file downloads.
Technical details
An integer overflow vulnerability exists in GNU Wget's 'src/http.c' within the 'parse_content_range()' function. The flaw is triggered when the client parses a 'Content-Range' HTTP header containing server-controlled values that exceed the limits of signed integer arithmetic. A remote attacker hosting a malicious server can exploit this by sending specially crafted headers to a Wget client, resulting in undefined behavior or download desynchronization. The issue was addressed in Git commit 43d3ba9 by replacing manual digit-to-integer conversion loops with safer 'strtol' calls and range checking.
Affected products
- GNU Wget Through 1.25.0
Timeline
- 2026-06-29: patched: Fix authored in commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
- 2026-07-07: disclosed: Vulnerability published by VulnCheck and NVD