Every CVE Search/ Get API key

CVE-2026-16599

Denial of Service in GNU wget

5.1 MediumFix available

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.38%Unchanged since Aug 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
CVE-2026-16599
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-606
Updated
2026-11-02
EUVDEUVD-2026-65494 5.1

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
EUVD-2026-65494
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-48r3-mr49-jp8x 5.1

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality....

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
GHSA-48r3-mr49-jp8x
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-606
Updated
2026-11-02
NVD 5.1

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
CVE-2026-16599
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-606
Updated
2026-11-02
OSV 5.1

Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
CVE-2026-16599
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-606
Updated
2026-11-02
OSVDEBIAN-CVE-2026-16599 5.1

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
DEBIAN-CVE-2026-16599
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 16 moreShow less
OSVOESA-2026-3766 5.1

wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)

Record
OESA-2026-3766
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3767 5.1

wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)

Record
OESA-2026-3767
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3768 5.1

wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)

Record
OESA-2026-3768
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3769 5.1

wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)

Record
OESA-2026-3769
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3910 5.1

wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)

Record
OESA-2026-3910
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16599 5.1

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Record
UBUNTU-CVE-2026-16599
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVMGASA-2026-0386 No score

Updated wget packages fix a security vulnerability

Denial of Service in GNU wget. (CVE-2026-16599)

Record
MGASA-2026-0386
Updated
2026-11-02
OSVopenSUSE-SU-2026:11646-1 No score

wget-1.25.0-7.1 on GA media

These are all security issues fixed in the wget-1.25.0-7.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11646-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22011-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
openSUSE-SU-2026:22011-1
Updated
2026-11-02
OSVSUSE-SU-2026:23455-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:23455-1
Updated
2026-11-02
OSVSUSE-SU-2026:23520-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:23520-1
Updated
2026-11-02
OSVSUSE-SU-2026:23975-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:23975-1
Updated
2026-11-02
OSVSUSE-SU-2026:23991-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:23991-1
Updated
2026-11-02
OSVSUSE-SU-2026:4049-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:4049-1
Updated
2026-11-02
OSVSUSE-SU-2026:4053-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:4053-1
Updated
2026-11-02
OSVSUSE-SU-2026:4074-1 No score

Security update for wget

This update for wget fixes the following issue:

  • CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).
Record
SUSE-SU-2026:4074-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wget
Alpaquita:23
 1.21.3-r2 up to 1.21.4-r3
1.21.4-r3
wget
Alpaquita:25
 1.25.0-r1 up to 1.25.0-r3
1.25.0-r3
wget
Alpaquita:stream
 1.21.3-r2 up to 1.25.0-r3
1.25.0-r3
wget
Debian:12
 All versions, plus listed versions
1.21.3-11.21.3-1+deb12u11.21.4-11.24.5-11.24.5-21.25.0-11.25.0-21.25.0-3
 None known
wget
Debian:13
 All versions, plus listed versions
1.25.0-21.25.0-3
 None known
wget
Debian:14
 All versions, plus listed versions
1.25.0-21.25.0-3
 None known
wget
Mageia:10
 before 1.25.0-2.3.mga10
1.25.0-2.3.mga10
wget
Mageia:9
 before 1.21.4-1.5.mga9
1.21.4-1.5.mga9
wget
openEuler:20.03-LTS-SP4
 before 1.20.3-8.oe2003sp4
1.20.3-8.oe2003sp4
wget
openEuler:22.03-LTS-SP4
 before 1.21.2-8.oe2203sp4
1.21.2-8.oe2203sp4
Show 21 moreShow less
Affected packages
PackageAffectedFixed
wget
openEuler:24.03-LTS-SP1
 before 1.21.4-5.oe2403sp1
1.21.4-5.oe2403sp1
wget
openEuler:24.03-LTS-SP4
 before 1.21.4-5.oe2403sp4
1.21.4-5.oe2403sp4
wget
openEuler:24.03-LTS-SP3
 before 1.21.4-5.oe2403sp3
1.21.4-5.oe2403sp3
wget
SUSE:Linux Micro 6.0
 before 1.24.5-5.1
1.24.5-5.1
wget
SUSE:Linux Micro 6.1
 before 1.24.5-slfo.1.1_6.1
1.24.5-slfo.1.1_6.1
wget
SUSE:Linux Micro 6.2
 before 1.25.0-160000.4.1
1.25.0-160000.4.1
wget
SUSE:Linux Enterprise Server 16.0
 before 1.25.0-160000.4.1
1.25.0-160000.4.1
wget
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.25.0-160000.4.1
1.25.0-160000.4.1
wget
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.24.5-150700.3.12.1
1.24.5-150700.3.12.1
wget
SUSE:Linux Enterprise Micro 5.5
 before 1.20.3-150000.3.40.1
1.20.3-150000.3.40.1
wget
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.14-21.31.1
1.14-21.31.1
wget
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.14-2ubuntu11.14-5ubuntu11.15-1ubuntu11.15-1ubuntu1.14.04.11.15-1ubuntu1.14.04.2
Show 6 moreShow less
1.15-1ubuntu1.14.04.31.15-1ubuntu1.14.04.41.15-1ubuntu1.14.04.51.15-1ubuntu1.14.04.5+esm21.15-1ubuntu1.14.04.5+esm31.15-1ubuntu1.14.04.5+esm4
 None known
wget
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.17.1-1ubuntu11.17.1-1ubuntu1.11.17.1-1ubuntu1.21.17.1-1ubuntu1.3
Show 6 moreShow less
1.17.1-1ubuntu1.41.17.1-1ubuntu1.51.17.1-1ubuntu1.5+esm11.17.1-1ubuntu1.5+esm31.17.1-1ubuntu1.5+esm41.17.1-1ubuntu1.5+esm5
 None known
wget
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.19.1-3ubuntu11.19.1-3ubuntu1.11.19.2-1ubuntu11.19.3-2ubuntu11.19.4-1ubuntu2
Show 6 moreShow less
1.19.4-1ubuntu2.11.19.4-1ubuntu2.21.19.4-1ubuntu2.2+esm11.19.4-1ubuntu2.2+esm31.19.4-1ubuntu2.2+esm41.19.4-1ubuntu2.2+esm5
 None known
wget
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu11.20.3-1ubuntu21.20.3-1ubuntu2.11.20.3-1ubuntu2.1+esm21.20.3-1ubuntu2.1+esm31.20.3-1ubuntu2.1+esm4
 None known
wget
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.21-1ubuntu31.21-1ubuntu41.21-1ubuntu51.21.2-2ubuntu11.21.2-2ubuntu1.11.21.2-2ubuntu1.31.21.2-2ubuntu1.41.21.2-2ubuntu1.5
 None known
wget
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.21.3-1ubuntu11.21.4-1ubuntu11.21.4-1ubuntu21.21.4-1ubuntu31.21.4-1ubuntu4
Show 4 moreShow less
1.21.4-1ubuntu4.11.21.4-1ubuntu4.31.21.4-1ubuntu4.41.21.4-1ubuntu4.5
 None known
wget
Ubuntu:26.10
 All versions, plus listed versions
1.25.0-2ubuntu41.25.0-2ubuntu61.25.0-3ubuntu1
 None known
wget
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.25.0-2ubuntu31.25.0-2ubuntu41.25.0-2ubuntu4.21.25.0-2ubuntu4.31.25.0-2ubuntu4.4
 None known
wget
openSUSE:Tumbleweed
 before 1.25.0-7.1
1.25.0-7.1
wget
openSUSE:Leap 16.0
 before 1.25.0-160000.4.1
1.25.0-160000.4.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16599 is a medium vulnerability (CVSS 5.1) in Gnu Wget, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in wget 1.21.4-r3.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open