Quick answers
- Is CVE-2026-58470 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58470 being exploited in the wild.
- How severe is CVE-2026-58470?
- Medium severity, with a CVSS score of 5.3, published 7 July 2026.
- Which products and versions are affected?
- Gnu Wget Through 1.25.0.
- Is there a fix for CVE-2026-58470?
- A patch was published on 2026-06-29: Fix authored in commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58470 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-58470?
- Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability exists in GNU Wget's 'src/http.c' within the 'parse_content_range()' function. The flaw is triggered when the client parses a 'Content-Range' HTTP header containing server-controlled values that exceed the limits of signed integer arithmetic. A remote attacker hosting a malicious server can exploit this by sending specially crafted headers to a Wget client, resulting in undefined behavior or download desynchronization. The issue was addressed in Git commit 43d3ba9 by replacing manual digit-to-integer conversion loops with safer 'strtol' calls and range checking.
Affected products
- GNU Wget Through 1.25.0
Timeline
- 2026-06-29: patched: Fix authored in commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
- 2026-07-07: disclosed: Vulnerability published by VulnCheck and NVD