CVE-2026-58470 Overview
CVE-2026-58470 is an integer overflow vulnerability in GNU Wget through version 1.25.0. The flaw resides in the parse_content_range() function in src/http.c and is triggered by attacker-controlled values in the HTTP Content-Range response header. Signed integer arithmetic overflows when Wget parses malicious server responses, producing undefined behavior and download desynchronization on the client. The issue is fixed in upstream commit 43d3ba9. This weakness is classified under CWE-190: Integer Overflow or Wraparound and affects any workflow where Wget fetches content from untrusted or attacker-influenced HTTP servers.
Critical Impact
A malicious or compromised HTTP server can send a crafted Content-Range header to a vulnerable Wget client, causing signed integer overflow and desynchronized downloads that may corrupt retrieved files.
Affected Products
- GNU Wget versions up to and including 1.25.0
- Any Linux/Unix distribution shipping Wget builds prior to commit 43d3ba9
- Automation, CI/CD, and scripting environments that invoke Wget against untrusted HTTP endpoints
Discovery Timeline
- 2026-07-07 - CVE-2026-58470 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-58470
Vulnerability Analysis
GNU Wget parses HTTP range metadata using the parse_content_range() routine in src/http.c. That routine converts numeric fields from the Content-Range response header into signed integer variables without validating that the values fit within the destination type. When a server returns a header containing extremely large numeric ranges, arithmetic performed on those signed integers wraps around, producing incorrect offsets and byte counts.
The vulnerability has network attack vector reachability and requires no authentication or user interaction beyond initiating a download. Impact is limited to availability and download integrity of the client process. There is no CISA KEV listing, no public exploit code, and no known in-the-wild abuse at time of publication.
Root Cause
The root cause is missing bounds validation on numeric fields parsed from the Content-Range header prior to signed integer arithmetic in parse_content_range(). Because C signed integer overflow is undefined behavior, compilers may optimize checks away, leaving the resulting offsets and sizes inconsistent with the actual byte stream. The fix in commit 43d3ba9 tightens parsing and validates the parsed values before they are used.
Attack Vector
Exploitation requires the victim to run wget against a server the attacker controls or has compromised, or to be redirected through an on-path adversary capable of injecting HTTP responses. The malicious server returns an HTTP 206 Partial Content response with a crafted Content-Range header containing values chosen to overflow signed integer arithmetic inside parse_content_range(). The overflow leads to download desynchronization, where the client writes bytes at unexpected offsets or truncates ranges, corrupting the resulting file. See the VulnCheck advisory on Wget for a detailed writeup.
No verified public proof-of-concept code is available. Refer to the upstream GitLab commit for the exact code paths and the corrective patch.
Detection Methods for CVE-2026-58470
Indicators of Compromise
- HTTP responses containing Content-Range headers with numeric fields near or exceeding INT_MAX (2147483647).
- Wget downloads that complete without error but produce files of unexpected size, incorrect checksums, or truncated content.
- Unexpected wget invocations in CI/CD pipelines pulling from newly introduced or unverified hostnames.
Detection Strategies
- Inventory installed Wget versions across servers, developer workstations, and build agents; flag any binary at or below 1.25.0 that does not include commit 43d3ba9.
- Inspect proxy or web gateway logs for outbound HTTP 206 Partial Content responses carrying anomalously large Content-Range values.
- Compare downloaded artifact hashes against expected values in software supply-chain pipelines to detect desynchronized downloads.
Monitoring Recommendations
- Alert on Wget process executions that resolve to non-approved external hosts, particularly from build systems and package mirrors.
- Monitor for repeated partial-content responses to the same client where reported ranges do not align with the eventual file size.
- Track package-management telemetry for wget upgrades to confirm remediation coverage across the fleet.
How to Mitigate CVE-2026-58470
Immediate Actions Required
- Upgrade GNU Wget to a build that includes commit 43d3ba9 from the upstream GitLab repository.
- Apply distribution security updates as soon as vendor-backported packages become available for supported Linux releases.
- Restrict Wget usage in automated pipelines to trusted, TLS-authenticated endpoints and pinned mirrors.
Patch Information
The vulnerability is fixed in the upstream GNU Wget repository by commit 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf, which corrects the parsing logic in parse_content_range() inside src/http.c. Distribution maintainers are expected to backport this patch into stable Wget packages. See the GitLab commit for Wget and the VulnCheck advisory for full technical details.
Workarounds
- Replace wget calls with curl --fail in scripts that fetch from external sources until patched packages are deployed.
- Force full-content downloads by avoiding range resumption flags such as -c when interacting with untrusted servers.
- Route Wget traffic through an HTTP proxy that strips or normalizes Content-Range headers on responses from unapproved origins.
# Verify installed Wget version and confirm the patched commit is present
wget --version | head -n 1
# Example Debian/Ubuntu remediation once the distro package is updated
sudo apt update && sudo apt install --only-upgrade wget
# Example RHEL/Fedora remediation
sudo dnf upgrade wget
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
