CVE-2018-0494

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in...

6.5 MediumPublic exploitFix available

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

16.5%Up 4.7 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: CVE-2018-0494
Updated: 2026-11-02

EUVDEUVD-2018-1317 No score

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: EUVD-2018-1317
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7cw3-q27m-9w5f 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in...

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: GHSA-7cw3-q27m-9w5f
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVALPINE-CVE-2018-0494 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: ALPINE-CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVBELL-CVE-2018-0494 6.5

CVE-2018-0494 does not affect BellSoft software

Record: BELL-CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 9 moreShow less

OSV 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-03

OSVDEBIAN-CVE-2018-0494 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: DEBIAN-CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2018:3052 7.1

Red Hat Security Advisory: wget security and bug fix update

Record: RHSA-2018:3052
CVSS 3.0: 7.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-0494 6.5

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Record: UBUNTU-CVE-2018-0494
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVMGASA-2018-0244 No score

Updated wget packages fix security vulnerabilities

Harry Sintonen discovered that wget does not properly handle '\r\n' from continuation lines while parsing the Set-Cookie HTTP header. A malicious web server could use this flaw to inject arbitrary cookies to the cookie jar file, adding new or replacing existing cookie values (CVE-2018-0494).

The Mageia 6 package has been updated to version 1.19.5, which fixes this issue as well as other possible security issues found by fuzzing. The Mageia 5 package has been patched to fix CVE-2018-0494.

Record: MGASA-2018-0244
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11510-1 No score

wget-1.21.1-2.2 on GA media

These are all security issues fixed in the wget-1.21.1-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11510-1
Updated: 2026-11-02

OSVSUSE-SU-2018:1367-1 No score

Security update for wget

This update for wget fixes the following issues:

CVE-2018-0494: Fixed Cookie injection vulnerability by checking for and joining continuation lines. (bsc#1092061)

Record: SUSE-SU-2018:1367-1
Updated: 2026-11-02

OSVSUSE-SU-2018:1373-1 No score

Security update for wget

This update for wget fixes the following issues:

CVE-2018-0494: Fixed a cookie injection vulnerability by checking for and joining continuation lines. (bsc#1092061)

Record: SUSE-SU-2018:1373-1
Updated: 2026-11-02

OSVUSN-3643-1 No score

wget vulnerability

It was discovered that Wget incorrectly handled certain inputs. An attacker could possibly use this to inject arbitrary cookie values.

Record: USN-3643-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wget` Alpine:v3.10	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.11	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.12	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.13	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.14	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.15	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.16	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.17	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.18	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.19	before 1.19.5-r0	1.19.5-r0

Show 37 moreShow less

Affected packages
Package	Affected	Fixed
`wget` Alpine:v3.20	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.21	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.22	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.23	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.24	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.4	before 1.18-r3	1.18-r3
`wget` Alpine:v3.5	before 1.18-r4	1.18-r4
`wget` Alpine:v3.6	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.7	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.8	before 1.19.5-r0	1.19.5-r0
`wget` Alpine:v3.9	before 1.19.5-r0	1.19.5-r0
`wget` Debian:12	before 1.19.5-1	1.19.5-1
`wget` Debian:13	before 1.19.5-1	1.19.5-1
`wget` Debian:14	before 1.19.5-1	1.19.5-1
`wget` Debian:7	before 1.13.4-3+deb7u6, plus listed versions 1.13.4-31.13.4-3+deb7u11.13.4-3+deb7u21.13.4-3+deb7u31.13.4-3+deb7u41.13.4-3+deb7u5	1.13.4-3+deb7u6
`wget` Debian:8	before 1.16-1+deb8u5, plus listed versions 1.16-11.16-1+deb8u11.16-1+deb8u21.16-1+deb8u4	1.16-1+deb8u5
`wget` Debian:9	before 1.18-5+deb9u2, plus listed versions 1.18-51.18-5+deb9u1	1.18-5+deb9u2
`wget` Mageia:5	before 1.15-5.4.mga5	1.15-5.4.mga5
`wget` Mageia:6	before 1.19.5-1.mga6	1.19.5-1.mga6
`wget` Red Hat:enterprise_linux:7::client	before 0:1.14-18.el7	0:1.14-18.el7
`wget-debuginfo` Red Hat:enterprise_linux:7::client	before 0:1.14-18.el7	0:1.14-18.el7
`wget` Red Hat:enterprise_linux:7::computenode	before 0:1.14-18.el7	0:1.14-18.el7
`wget-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:1.14-18.el7	0:1.14-18.el7
`wget` Red Hat:enterprise_linux:7::server	before 0:1.14-18.el7	0:1.14-18.el7
`wget-debuginfo` Red Hat:enterprise_linux:7::server	before 0:1.14-18.el7	0:1.14-18.el7
`wget` Red Hat:enterprise_linux:7::workstation	before 0:1.14-18.el7	0:1.14-18.el7
`wget-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:1.14-18.el7	0:1.14-18.el7
`wget-openssl1` SUSE:Linux Enterprise Server 11-SECURITY	before 1.11.4-1.41.3.1	1.11.4-1.41.3.1
`wget` SUSE:Linux Enterprise Server 11 SP4	before 1.11.4-1.41.3.1	1.11.4-1.41.3.1
`wget` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	before 1.11.4-1.41.3.1	1.11.4-1.41.3.1
`wget` SUSE:Linux Enterprise Desktop 12 SP3	before 1.14-21.7.1	1.14-21.7.1
`wget` SUSE:Linux Enterprise Server 12 SP3	before 1.14-21.7.1	1.14-21.7.1
`wget` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	before 1.14-21.7.1	1.14-21.7.1
`wget` Ubuntu:14.04:LTS	before 1.15-1ubuntu1.14.04.4, plus listed versions 1.14-2ubuntu11.14-5ubuntu11.15-1ubuntu11.15-1ubuntu1.14.04.11.15-1ubuntu1.14.04.21.15-1ubuntu1.14.04.3	1.15-1ubuntu1.14.04.4
`wget` Ubuntu:16.04:LTS	before 1.17.1-1ubuntu1.4, plus listed versions 1.16.1-1ubuntu11.17.1-1ubuntu11.17.1-1ubuntu1.11.17.1-1ubuntu1.21.17.1-1ubuntu1.3	1.17.1-1ubuntu1.4
`wget` Ubuntu:18.04:LTS	before 1.19.4-1ubuntu2.1, plus listed versions 1.19.1-3ubuntu11.19.1-3ubuntu1.11.19.2-1ubuntu11.19.3-2ubuntu11.19.4-1ubuntu2	1.19.4-1ubuntu2.1
`wget` openSUSE:Tumbleweed	before 1.21.1-2.2	1.21.1-2.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GNU wget - Cookie Injection	2018-05-06

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-0494 is a medium vulnerability (CVSS 6.5) in Gnu Wget, published May 6, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.5%, the 96th percentile. Fixed in wget 1.19.5-r0.

References

Show 34 moreShow less