GNU wget CVE-2026-16599

Exploitation requires that the targeted wget instance connect to an FTP server that presents an OPIE/S-KEY challenge during authentication - a non-default, legacy authentication mechanism uncommon in modern FTP deployments. The attacker must control the FTP server (e.g., a malicious endpoint) or occupy a network-adjacent position enabling interception and modification of the FTP control channel to inject a crafted challenge. UI:A in the CVSS 4.0 vector confirms the user or script must actively initiate the FTP connection. Limiting factors include: the rarity of OPIE/S-KEY FTP deployments in practice; the need for network interception capability for MitM scenarios; and the DoS impact being confined to the wget process, not the broader host. The --timeout wget option does NOT limit exploitation once the CPU loop begins.

The CVSS 4.0 score of 5.1 (Medium) reflects a network-accessible, low-complexity attack requiring active user interaction (UI:A), with impact limited to wget's own availability (VA:L) and no confidentiality or integrity impact. The attack requires either a malicious FTP server or a network-positioned MitM, making opportunistic mass exploitation impractical. OPIE/S-KEY FTP authentication is a deprecated, rarely-deployed protocol, substantially reducing the real-world attack surface even though wget itself is ubiquitous. No CISA KEV listing and no public exploit exist, and EPSS data was not provided - indicating low current exploitation activity. The --timeout bypass noted in the description is a meaningful nuance: defenders cannot rely on existing timeout-based protections. Overall this is a low-urgency, targeted-scenario vulnerability: highest risk for automated wget-based FTP pipelines connecting to untrusted or externally-controlled FTP endpoints using OPIE/S-KEY.

An attacker operates or compromises an FTP server that advertises OPIE/S-KEY authentication, or positions themselves as a network MitM capable of modifying FTP control-channel traffic. When a user or automated script invokes wget against that FTP endpoint, the attacker sends a crafted OPIE challenge containing a sequence number of 2,147,483,647 (INT_MAX). wget enters the unbounded MD5 derivation loop, consuming all available CPU on that process and suspending for an extended period, effectively denying the wget instance its intended function. No public exploit code is known at time of analysis.