CVE-2026-58470 GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing
Attackers can cause denial of service in GNU Wget by sending malicious Content-Range headers that trigger an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58470?
CVE-2026-58470 is a medium-severity vulnerability in gnuwget wget, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.
Weakness: CWE-190
Which versions are affected by CVE-2026-58470?
It affects 1 product.
Products include Gnu Wget.
How do I fix CVE-2026-58470?
Apply the vendor's patch.
Is CVE-2026-58470 being exploited?
There is no known exploitation of CVE-2026-58470 in the wild and no public exploit code.
Other vulnerabilities in gnuwget wget
Sources
Also known as CLSA-2026-1784310537, DEBIAN-CVE-2026-58470, ECHO-18f1-7a81-eb45, GHSA-5f52-px6m-c5hw, JLSEC-2026-1159, ROOT-OS-DEBIAN-11-CVE-2026-58470 and 2 more.