CVE-2026-58469: GNU Wget Buffer Overflow Vulnerability

CVE-2026-58469 Overview

CVE-2026-58469 is a heap buffer underread vulnerability in GNU Wget through version 1.25.0. The flaw resides in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document containing a whitespace-only URL. When Wget processes such input, the function decrements a pointer past the start of the heap buffer, leading to abnormal program behavior. The issue is tracked under [CWE-125] (Out-of-bounds Read) and was fixed in commit 37a40fc. Any client or automated workflow that fetches Metalink documents from untrusted servers is exposed to this vulnerability.

Critical Impact
A remote, unauthenticated attacker operating a malicious server can trigger a heap buffer underread in Wget, causing process crashes and potential memory disclosure across automated download workflows.

Affected Products

GNU Wget versions up to and including 1.25.0
Linux distributions bundling vulnerable Wget builds
Automation pipelines and container images relying on Wget for Metalink downloads

Discovery Timeline

2026-07-07 - CVE-2026-58469 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-58469

Vulnerability Analysis

The vulnerability lives in clean_metalink_string() in src/metalink.c. This helper trims leading and trailing whitespace from Metalink URL strings before Wget consumes them. When the input string consists entirely of whitespace characters, the trimming logic advances past the terminating condition. The function then decrements a pointer beyond the start of the heap-allocated buffer, producing an out-of-bounds read below the allocation boundary.

Wget parses Metalink documents automatically when a server responds with a Metalink descriptor or when the client is invoked with Metalink support. An attacker who controls the server, or who can intercept traffic, can return a crafted Metalink XML/HTTP response with a <url> element containing only whitespace. Processing that entry drives the pointer underread and disrupts the process state.

Because the read occurs on the heap, the leaked bytes may include unrelated allocator metadata or adjacent object contents. The primary observed impact is availability loss through crashes in automation pipelines and mirrors. Fixed upstream in commit 37a40fc.

Root Cause

The root cause is missing input validation for empty or whitespace-only strings in clean_metalink_string(). The trimming loop lacks a guard that stops pointer decrement when the buffer start is reached, allowing the pointer to reference memory before the allocation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond initiating a Wget request. An adversary hosts a malicious mirror or performs a man-in-the-middle attack against an insecure channel, then returns a Metalink document containing a whitespace-only URL entry to trigger the flaw.

No verified public exploit or proof-of-concept is available at this time. Technical details are documented in the VulnCheck Security Advisory and the upstream GitLab Commit Change.

Detection Methods for CVE-2026-58469

Indicators of Compromise

Wget process crashes or SIGSEGV terminations correlated with Metalink downloads
HTTP responses of type application/metalink4+xml or application/metalink+xml from untrusted servers
Metalink documents containing <url> elements with whitespace-only content
Repeated abnormal exits of automation jobs invoking wget --metalink-over-http or wget --input-metalink

Detection Strategies

Inventory installed Wget versions across endpoints and containers, flagging builds at or below 1.25.0
Inspect HTTP response bodies for Metalink documents containing empty or whitespace-only URL fields
Correlate crash telemetry from Wget processes with outbound connections to unverified hosts

Monitoring Recommendations

Alert on abnormal termination of Wget processes on servers, build agents, and CI runners
Log outbound Wget invocations that include Metalink flags or fetch Metalink content types
Monitor package management systems for outdated wget packages pending patch deployment

How to Mitigate CVE-2026-58469

Immediate Actions Required

Upgrade Wget to a build that includes commit 37a40fc or later across all systems
Restrict Wget usage against untrusted mirrors and enforce HTTPS with certificate validation
Rebuild container images and golden images that ship vulnerable Wget binaries
Audit CI/CD scripts and automation for --metalink-over-http and --input-metalink usage

Patch Information

The upstream fix is available in GNU Wget commit 37a40fcb450153f69537c7cbc2a7a4fb0b6f7826, which adds bounds checking in clean_metalink_string() to prevent pointer decrement past the buffer start. Apply distribution-provided security updates as they become available. Reference the GitLab Commit Change for the exact patch content.

Workarounds

Disable Metalink processing by invoking Wget without --metalink-over-http or --input-metalink flags
Replace Wget with curl for Metalink workflows until patched builds are deployed
Route downloads through a controlled proxy that validates Metalink response content

bash

# Verify installed Wget version and check for the patched commit
wget --version | head -n 1

# Example: fetch files without engaging Metalink parsing
wget --no-metalink-over-http https://example.com/file.iso