Every CVE Search/ Get API key

CVE-2021-31879

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different...

6.1 MediumFix available

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.10%Up 0.7 points since Apr 29, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
CVE-2021-31879
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-601
Updated
2026-11-02
CVE List No score

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
CVE-2021-31879
Updated
2026-11-02
EUVDEUVD-2021-18754 No score

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
EUVD-2021-18754
Updated
2026-11-02
GitHub AdvisoriesGHSA-78qj-768g-464g 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different...

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
GHSA-78qj-768g-464g
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVAZL-6957 6.1

CVE-2021-31879 affecting package wget for versions less than 1.21.2-1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
AZL-6957
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
CVE-2021-31879
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2021-31879 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
DEBIAN-CVE-2021-31879
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVJLSEC-2026-118 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
JLSEC-2026-118
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-31879 6.1

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Record
UBUNTU-CVE-2021-31879
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1778811697 No score

wget: Fix of CVE-2021-31879

  • CVE-2021-31879: do not propagate Authorization/Cookie headers across HTTP 3xx redirects (openSUSE patch)
Record
CLSA-2026-1778811697
Updated
2026-11-02
OSVCLSA-2026-1784136800 No score

wget: Fix of CVE-2026-58470

  • CVE-2026-58470: fix integer overflow in parse_content_range
  • CVE-2021-31879: do not propagate Authorization/Cookie headers across HTTP 3xx redirects (openSUSE patch)
Record
CLSA-2026-1784136800
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2021-31879 No score

CVE-2021-31879 in wget - Patched by Root

Root has patched CVE-2021-31879 in the wget package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2021-31879
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2021-31879 No score

CVE-2021-31879 in wget - Patched by Root

Root has patched CVE-2021-31879 in the wget package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2021-31879
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2021-31879 No score

CVE-2021-31879 in wget - Patched by Root

Root has patched CVE-2021-31879 in the wget package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2021-31879
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2204-CVE-2021-31879 No score

CVE-2021-31879 in wget - Patched by Root

Root has patched CVE-2021-31879 in the wget package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2204-CVE-2021-31879
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2404-CVE-2021-31879 No score

CVE-2021-31879 in wget - Patched by Root

Root has patched CVE-2021-31879 in the wget package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2404-CVE-2021-31879
Updated
2026-11-02
OSVSUSE-SU-2025:0366-1 No score

Security update for wget

This update for wget fixes the following issues:

  • CVE-2021-31879: Authorization header disclosed upon redirects to different origins. (bsc#1185551)
Record
SUSE-SU-2025:0366-1
Updated
2026-11-02
OSVSUSE-SU-2025:0380-1 No score

Security update for wget

This update for wget fixes the following issues:

  • CVE-2021-31879: Authorization header disclosed upon redirects to different origins. (bsc#1185551)
Record
SUSE-SU-2025:0380-1
Updated
2026-11-02
OSVSUSE-SU-2025:0425-1 No score

Security update for wget

This update for wget fixes the following issues:

  • CVE-2021-31879: Authorization header disclosed upon redirects to different origins. (bsc#1185551)
Record
SUSE-SU-2025:0425-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wget
Azure Linux:2
 before 1.21.2-1
1.21.2-1
wget
TuxCare:AlmaLinux:9.2
 before 1.21.1-7.el9.tuxcare.els2
1.21.1-7.el9.tuxcare.els2
wget
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
wget
Debian:12
 All versions, plus listed versions
1.21.3-11.21.3-1+deb12u11.21.4-11.24.5-11.24.5-21.25.0-11.25.0-21.25.0-3
 None known
wget
Debian:13
 All versions, plus listed versions
1.25.0-21.25.0-3
 None known
wget
Debian:14
 All versions, plus listed versions
1.25.0-21.25.0-3
 None known
wget_jll
Julia
 before 1.21.4+0
1.21.4+0
wget
Root:Debian:11
 before 1.21-1+deb11u2.aikido.14
1.21-1+deb11u2.aikido.141.21-1+deb11u2.aikido.151.21-1+deb11u2.root.io.121.21-1+deb11u2.root.io.131.21-1+deb11u2.root.io.101.21-1+deb11u2.root.io.11
rootio-wget
Root:Debian:11
 before 1.21-1+deb11u2.aikido.14
1.21-1+deb11u2.aikido.141.21-1+deb11u2.aikido.151.21-1+deb11u2.root.io.121.21-1+deb11u2.root.io.131.21-1+deb11u2.root.io.101.21-1+deb11u2.root.io.11
wget
Root:Debian:12
 before 1.21.3-1+deb12u1.aikido.5
1.21.3-1+deb12u1.aikido.51.21.3-1+deb12u1.root.io.31.21.3-1+deb12u1.root.io.41.21.3-1+deb12u1.aikido.6
Show 20 moreShow less
Affected packages
PackageAffectedFixed
rootio-wget
Root:Debian:12
 before 1.21.3-1+deb12u1.aikido.5
1.21.3-1+deb12u1.aikido.51.21.3-1+deb12u1.root.io.31.21.3-1+deb12u1.root.io.41.21.3-1+deb12u1.aikido.6
wget
Root:Debian:13
 before 1.25.0-2.aikido.5
1.25.0-2.aikido.51.25.0-2.aikido.41.25.0-2.root.io.21.25.0-2.root.io.31.25.0-2.root.io.11.25.0-2.aikido.6
rootio-wget
Root:Debian:13
 before 1.25.0-2.aikido.5
1.25.0-2.aikido.51.25.0-2.aikido.41.25.0-2.root.io.21.25.0-2.root.io.31.25.0-2.root.io.11.25.0-2.aikido.6
wget
Root:Ubuntu:22.04
 before 1.21.2-2ubuntu1.5.aikido.3
1.21.2-2ubuntu1.5.aikido.3
rootio-wget
Root:Ubuntu:22.04
 before 1.21.2-2ubuntu1.5.aikido.3
1.21.2-2ubuntu1.5.aikido.3
wget
Root:Ubuntu:24.04
 before 1.21.4-1ubuntu4.5.aikido.3
1.21.4-1ubuntu4.5.aikido.3
rootio-wget
Root:Ubuntu:24.04
 before 1.21.4-1ubuntu4.5.aikido.3
1.21.4-1ubuntu4.5.aikido.3
wget
SUSE:Linux Enterprise Micro 5.5
 before 1.20.3-150000.3.29.1
1.20.3-150000.3.29.1
wget
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.14-21.22.1
1.14-21.22.1
wget
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 1.20.3-150600.19.12.1
1.20.3-150600.19.12.1
wget
openSUSE:Leap 15.6
 before 1.20.3-150600.19.12.1
1.20.3-150600.19.12.1
wget
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.14-2ubuntu11.14-5ubuntu11.15-1ubuntu11.15-1ubuntu1.14.04.11.15-1ubuntu1.14.04.2
Show 6 moreShow less
1.15-1ubuntu1.14.04.31.15-1ubuntu1.14.04.41.15-1ubuntu1.14.04.51.15-1ubuntu1.14.04.5+esm21.15-1ubuntu1.14.04.5+esm31.15-1ubuntu1.14.04.5+esm4
 None known
wget
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.17.1-1ubuntu11.17.1-1ubuntu1.11.17.1-1ubuntu1.21.17.1-1ubuntu1.3
Show 6 moreShow less
1.17.1-1ubuntu1.41.17.1-1ubuntu1.51.17.1-1ubuntu1.5+esm11.17.1-1ubuntu1.5+esm31.17.1-1ubuntu1.5+esm41.17.1-1ubuntu1.5+esm5
 None known
wget
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.19.1-3ubuntu11.19.1-3ubuntu1.11.19.2-1ubuntu11.19.3-2ubuntu11.19.4-1ubuntu2
Show 6 moreShow less
1.19.4-1ubuntu2.11.19.4-1ubuntu2.21.19.4-1ubuntu2.2+esm11.19.4-1ubuntu2.2+esm31.19.4-1ubuntu2.2+esm41.19.4-1ubuntu2.2+esm5
 None known
wget
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu11.20.3-1ubuntu21.20.3-1ubuntu2.11.20.3-1ubuntu2.1+esm21.20.3-1ubuntu2.1+esm31.20.3-1ubuntu2.1+esm4
 None known
wget
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.21-1ubuntu31.21-1ubuntu41.21-1ubuntu51.21.2-2ubuntu11.21.2-2ubuntu1.11.21.2-2ubuntu1.31.21.2-2ubuntu1.41.21.2-2ubuntu1.5
 None known
wget
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.21.3-1ubuntu11.21.4-1ubuntu11.21.4-1ubuntu21.21.4-1ubuntu31.21.4-1ubuntu4
Show 4 moreShow less
1.21.4-1ubuntu4.11.21.4-1ubuntu4.31.21.4-1ubuntu4.41.21.4-1ubuntu4.5
 None known
wget
Ubuntu:25.10
 All versions, plus listed versions
1.24.5-2ubuntu11.25.0-2ubuntu11.25.0-2ubuntu21.25.0-2ubuntu3
 None known
wget
Ubuntu:26.10
 All versions, plus listed versions
1.25.0-2ubuntu41.25.0-2ubuntu61.25.0-3ubuntu1
 None known
wget
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.25.0-2ubuntu31.25.0-2ubuntu41.25.0-2ubuntu4.21.25.0-2ubuntu4.31.25.0-2ubuntu4.4
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-31879 is a medium vulnerability (CVSS 6.1) in Gnu Wget, published April 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in wget 1.21.2-1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open