Full Report
Denial of Service vulnerability (CVE-2026-16599) has been found in GNU wget software.
Analysis Summary
# Vulnerability: Denial of Service in GNU wget FTP Authentication
## CVE Details
- **CVE ID:** CVE-2026-16599
- **CVSS Score:** Not explicitly listed in the source, but likely **Medium** (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **CWE:** CWE-606 (Unchecked input for loop condition)
## Affected Systems
- **Products:** GNU wget
- **Versions:** All versions through 1.25.0
- **Configurations:** Systems using `wget` to interact with FTP servers that utilize OPIE/S-KEY authentication functionality.
## Vulnerability Description
GNU wget is vulnerable to a CPU-exhaustion Denial of Service (DoS) within its FTP OPIE/S-KEY authentication handler. When `wget` connects to an FTP server, the server provides a challenge line containing a sequence number. `wget` uses this sequence number as an iteration count for an MD5 key-derivation loop.
The software fails to validate an upper bound for this sequence number. By sending a crafted challenge with a sequence number near the maximum integer value (`INT_MAX`), an attacker can force `wget` to perform approximately 2.1 billion MD5 computations. This results in the process hanging/suspending for a significant duration while consuming CPU resources.
## Exploitation
- **Status:** Reported (PoC capability described)
- **Complexity:** Low
- **Attack Vector:** Network (A malicious FTP server or a Man-in-the-Middle attacker can trigger the flaw by intercepting and modifying FTP traffic).
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** Partial (Process suspension/hang; the `--timeout` option is ineffective as it only governs network I/O, not CPU-bound tasks).
## Remediation
### Patches
- The issue has been addressed in the source code: **Commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa**.
- Users are advised to upgrade to versions released after August 25, 2026, or apply the specific commit to their local builds.
### Workarounds
- Avoid connecting to untrusted FTP servers.
- Use HTTPS instead of FTP where possible to prevent network-based interception/injection of malicious challenge lines.
## Detection
- **Indicators of Compromise:** Wget processes that appear to hang or consume 100% CPU usage immediately following an FTP authentication handshake.
- **Detection Methods:** Monitor for FTP traffic containing unusually large sequence numbers in OPIE challenges.
## References
- **Vendor Advisory:** hXXps[://]cert[.]pl/en/posts/2026/08/cve-2026-16599/
- **CVE Record:** hXXps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-16599
- **CWE-606:** hXXps[://]cwe[.]mitre[.]org/data/definitions/606[.]html