# CVE-2026-58470: GNU Wget integer overflow in parse_content_range

Source: https://junglewise.ai/threats/cve-2026-58470-gnu-wget-integer-overflow-in-parse-content-range  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-58470 · Severity: medium · CVSS 5.3 · Published 2026-07-07

GNU Wget is a widely used command-line tool for downloading files from the internet. A vulnerability in how it processes server responses could allow a malicious web server to cause the tool to crash or behave unpredictably. This could disrupt automated data collection processes or lead to incomplete file downloads.

Technologies: [Gnu Wget](https://junglewise.ai/threats/technologies/wget). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-58470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58470 being exploited in the wild.

**How severe is CVE-2026-58470?** Medium severity, with a CVSS score of 5.3, published 7 July 2026.

**Which products and versions are affected?** Gnu Wget Through 1.25.0.

**Is there a fix for CVE-2026-58470?** A patch was published on 2026-06-29: Fix authored in commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58470 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58470?** Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in GNU Wget's 'src/http.c' within the 'parse_content_range()' function. The flaw is triggered when the client parses a 'Content-Range' HTTP header containing server-controlled values that exceed the limits of signed integer arithmetic. A remote attacker hosting a malicious server can exploit this by sending specially crafted headers to a Wget client, resulting in undefined behavior or download desynchronization. The issue was addressed in Git commit 43d3ba9 by replacing manual digit-to-integer conversion loops with safer 'strtol' calls and range checking.

## Affected products

- GNU Wget Through 1.25.0

## Timeline

- 2026-06-29: patched: Fix authored in commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
- 2026-07-07: disclosed: Vulnerability published by VulnCheck and NVD

## References

- [https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf](https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf)
- [https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-range-header-parsing](https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-range-header-parsing)

## Related threats

- [GNU wget local code execution via hardcoded config path](https://junglewise.ai/threats/cve-2026-94574-a-local-cross-user-code-execution-vulnerability-exists-in-gnu)
- [GNU wget denial of service in FTP OPIE/S-KEY authentication](https://junglewise.ai/threats/cve-2026-16599-gnu-wget-denial-of-service-in-ftp-opie-s-key-authentication)
- [GNU Wget SSRF via unvalidated FTP PASV IP address](https://junglewise.ai/threats/cve-2026-15146-gnu-wget-ssrf-via-unvalidated-ftp-pasv-ip-address)
- [GNU Wget heap buffer underread in clean_metalink_string](https://junglewise.ai/threats/cve-2026-58469-gnu-wget-heap-buffer-underread-in-clean-metalink-string)