GNU wget2 CVE-2026-1858

Apply the vendor-released patch for wget2 certificate validation as soon as it becomes available through the GNU wget2 project. Until a patched version is available, implement network-level mitigations: deploy certificate pinning or HPKB (HTTP Public Key Binding) policies in environments controlling wget2 deployments to restrict accepted certificates to a whitelist of known legitimate issuers and public key hashes. For automated downloads or CI/CD pipelines using wget2, enforce DNSSEC validation and certificate transparency (CT) log verification on the client side where possible, or use a proxy with advanced certificate inspection (e.g., Squid, mitmproxy in non-MITM mode for monitoring). Operationally, restrict wget2 usage to non-sensitive data retrieval where feasible, and prefer curl or newer HTTP clients with stronger default certificate validation. Monitor certificate issuance logs from your organization's trusted CAs for unexpected certificate generation outside normal business processes. No formal patch version has been publicly identified at the time of analysis; check the GNU wget2 project website and security advisories for availability of fixed builds.