CVE-2026-16599 Overview
CVE-2026-16599 is a denial-of-service vulnerability in GNU wget affecting its File Transfer Protocol (FTP) OPIE/S-KEY authentication logic. The server-supplied sequence number from an FTP challenge line is used as an iteration count for an MD5 key-derivation loop without upper-bound validation [CWE-606]. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge containing a sequence number near INT_MAX. The client then performs up to approximately 2.1 billion MD5 computations and suspends for an extended period. The --timeout option does not mitigate the issue because it applies only to network I/O, not CPU-bound computation.
Critical Impact
A single crafted FTP OPIE challenge can force wget into billions of MD5 iterations, hanging automated download workflows, mirroring jobs, and scripted pipelines.
Affected Products
- GNU wget versions prior to commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
- Any distribution packaging affected upstream wget builds
- Automation and scripting environments that invoke wget against untrusted FTP endpoints
Discovery Timeline
- 2026-08-25 - CVE CVE-2026-16599 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-16599
Vulnerability Analysis
The defect lives in the FTP client path that handles OPIE (One-time Passwords In Everything) and S/KEY authentication. When an FTP server sends a challenge line, wget parses a sequence number that indicates how many MD5 rounds to apply during key derivation. The parsed integer is passed directly to the hashing loop as an iteration counter. No sanity check confines it to the small values expected by the OPIE specification.
When the sequence number approaches INT_MAX, the loop performs on the order of 2.1 billion MD5 computations. The process becomes CPU-bound and unresponsive. Because --timeout governs socket I/O rather than CPU execution, the flag provides no relief. Batch jobs, package fetch scripts, and mirroring pipelines that call wget against attacker-controlled or intercepted FTP servers stall until the loop completes or the process is killed.
Root Cause
The root cause is unrestricted trust of an externally supplied loop bound, classified under [CWE-606] Unchecked Input for Loop Condition. The FTP challenge parser converts the sequence field to an integer and uses it as the MD5 iteration count without validating that it falls within the specification-defined range for OPIE/S-KEY.
Attack Vector
Exploitation requires the victim to initiate an FTP connection that either terminates at a malicious server or traverses an attacker-controlled network path. The attacker responds to the client with an OPIE challenge containing a sequence value near INT_MAX. wget then enters a prolonged MD5 loop. No authentication or user interaction beyond invoking wget against the attacker-influenced endpoint is required.
No public proof-of-concept code is referenced in the advisory. The upstream fix is available in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa in the GitLab GNU Wget repository.
Detection Methods for CVE-2026-16599
Indicators of Compromise
- wget processes consuming sustained 100% CPU on a single core while connected to an FTP server
- FTP sessions in which the server response includes an OPIE or S/KEY challenge with an unusually large sequence number
- Long-running or hung wget invocations in cron jobs, CI/CD pipelines, or package mirror scripts targeting FTP URLs
Detection Strategies
- Inspect FTP control-channel traffic for OPIE/S-KEY challenge lines and flag sequence numbers outside the expected small range defined by the OPIE specification.
- Baseline expected runtime for scripted wget FTP jobs and alert on executions that exceed the baseline by a significant margin.
- Correlate process telemetry showing wget at high CPU with concurrent FTP network sessions to identify DoS conditions.
Monitoring Recommendations
- Collect endpoint process metrics (CPU time, wall-clock duration) for wget invocations and forward them to a centralized logging or SIEM platform.
- Monitor egress FTP connections from build servers, mirrors, and automation hosts; alert on connections to untrusted destinations.
- Track patch state of the wget package across the fleet to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-16599
Immediate Actions Required
- Update wget to a build that includes upstream commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa as tracked in the CERT Polska advisory.
- Audit scripts, cron jobs, and CI/CD pipelines that call wget against FTP endpoints and restrict them to trusted servers.
- Prefer HTTPS mirrors over FTP where the download source offers both.
Patch Information
The issue is fixed upstream in GNU wget commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa. Rebuild from source at or after that commit, or install the patched package from your Linux distribution once it ships an updated build. Track your distribution's security advisory feed for the specific package version that incorporates the fix.
Workarounds
- Disable FTP fetches in automation and use HTTPS-only sources until patched builds are deployed.
- Route FTP traffic through an egress proxy that terminates or rewrites OPIE challenges, or blocks FTP entirely on hosts that do not require it.
- Run wget under a wall-clock watchdog such as timeout 60 wget ... so CPU-bound hangs are terminated regardless of the ineffective --timeout flag.
# Wrap wget calls with a wall-clock kill switch since --timeout does not cover CPU-bound loops
timeout 60 wget --no-passive-ftp ftp://example.invalid/path/file
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
