GNU Wget CVE-2026-58470

Exploitation requires the victim wget client to initiate an HTTP or HTTPS connection to an attacker-controlled or attacker-compromised server that returns a crafted Content-Range response header. The Content-Range parsing path is most directly triggered during resumable downloads (wget -c flag) or when the server elects to respond with HTTP 206 Partial Content. No authentication is required and no special client-side configuration is needed (PR:N, UI:N per CVSS 4.0 vector), though the victim must connect to the malicious server - wget cannot be exploited as a listener. Exploitation is strictly client-initiated and requires the victim to make a download request to the attacker's origin. The impact is bounded to download desynchronization (VA:L) based on current data; no conditions enabling code execution or confidentiality breach on the client host have been confirmed. Non-interactive automated wget usage (scripts, cron jobs, pipelines) without origin allowlisting represents the highest-risk deployment pattern.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9) positions this as a medium-severity, network-accessible, zero-prerequisite flaw with low availability impact and no confidentiality or integrity impact. The stated impact is download desynchronization - a client-side corruption of the download session rather than host-level availability loss. EPSS data is not provided in available intelligence, so probabilistic exploitation likelihood cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, making active exploitation unlikely in the near term. The practical risk is highest for automated pipelines running wget against third-party or untrusted URLs, where silent file corruption could propagate into build artifacts or deployed software. A theoretical escalation path exists because signed integer overflow in C is undefined behavior - aggressive compiler optimizations could theoretically produce memory corruption outcomes - but no such impact is confirmed by available data, and the current assessment should treat the impact as bounded to VA:L unless new evidence emerges. Overall, this is a genuine but non-urgent priority: patch when distributions ship updates, and prioritize hardening automated wget usage against untrusted origins in the interim.

An attacker operates a malicious web server (or performs a man-in-the-middle attack against HTTP traffic) and waits for a victim's wget client to request a file. The server responds with an HTTP 206 Partial Content message containing a Content-Range header crafted with values that overflow a signed integer in parse_content_range(), triggering undefined behavior that desynchronizes the download state - causing the victim to receive a silently corrupted or incomplete file without a clear error indication. In CI/CD pipelines or automated build systems that fetch dependencies via wget without checksum verification, this could result in corrupted build artifacts being used in production deployments.