Wget (Gnu) - vulnerabilities (CVEs)

24 CVEs, 0 in the last 30 days, 53 known versions, newest CVE from 2026-08-25. Vendor: Gnu.

CVEs of Wget

• CVE-2026-16599 - CVSS 5.1 (medium), 2026-08-25: GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge…
• CVE-2026-58472 - CVSS 7.1 (high), 2026-07-07: GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that…
• CVE-2026-58471 - CVSS 7.1 (high), 2026-07-07: GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows…
• CVE-2026-58470 - CVSS 6.9 (medium), 2026-07-07: GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that…
• CVE-2026-58469 - CVSS 8.7 (high), 2026-07-07: GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c…
• CVE-2024-10524 - CVSS 6.5 (medium), 2024-11-19: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases…
• CVE-2024-38428 - CVSS 9.1 (critical), 2024-06-16: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was…
• CVE-2021-31879 - CVSS 6.1 (medium), 2021-04-29: GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
• CVE-2019-5953 - CVSS 9.8 (critical), 2019-05-17: Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified…
• CVE-2018-20483 - CVSS 7.8 (high), 2018-12-26: set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of…
• CVE-2018-0494 - CVSS 6.5 (medium), 2018-05-06: GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.
• CVE-2017-13089 - CVSS 8.8 (high), 2017-10-27: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before…
• CVE-2017-13090 - CVSS 8.8 (high), 2017-10-27: The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses…
• CVE-2017-6508 - CVSS 6.1 (medium), 2017-03-07: CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF…
• CVE-2016-7098 - CVSS 8.1 (high), 2016-09-26: Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended…
• CVE-2016-4971 - CVSS 8.8 (high), 2016-06-30: GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
• CVE-2014-4877 - CVSS 9.3 (critical), 2014-10-29: Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and…
• CVE-2010-2252 - CVSS 6.8 (medium), 2010-07-06: GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote…
• CVE-2009-3490 - CVSS 6.8 (medium), 2009-09-30: GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows…
• CVE-2006-6719 - CVSS 5 (medium), 2006-12-23: The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application…
• CVE-2004-1488 - CVSS 5 (medium), 2005-04-27: wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers…
• CVE-2004-1487 - CVSS 5 (medium), 2005-04-27: wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address…
• CVE-2004-2014 - CVSS 2.6 (low), 2004-12-31: Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.
• CVE-2002-1344 - CVSS 5 (medium), 2002-12-18: Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1)…
• CVE-1999-0402 - CVSS 5 (medium), 1999-01-02: wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.