{"id":"CVE-2016-7098","aliases":["DEBIAN-CVE-2016-7098","DLA-2086-1","EUVD-2016-7978","GHSA-57mm-2gj4-2977","MGASA-2016-0323","SUSE-SU-2016:2358-1","SUSE-SU-2016:3268-1","UBUNTU-CVE-2016-7098","USN-3464-1"],"status":"published","title":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a...","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07499,"percentile":0.94525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-362"],"published":"2016-09-23T12:56:12Z","modified":"2026-09-22T07:00:51Z","exploits":[{"source":"exploitdb","id":"EDB-40824","title":"GNU Wget \u003c 1.18 - Access List Bypass / Race Condition","type":"remote","platform":"multiple","date":"2016-11-24","verified":true,"url":"https://www.exploit-db.com/exploits/40824"}],"fixes":[{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.18-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.18-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.18-4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"wget","fixed_in":["1.16-1+deb8u7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"wget","fixed_in":["1.14-17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wget","fixed_in":["1.15-1ubuntu1.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wget","fixed_in":["1.17.1-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-4"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-1+deb8u7"}]}],"versions":["1.16-1","1.16-1+deb8u1","1.16-1+deb8u2","1.16-1+deb8u4","1.16-1+deb8u5","1.16-1+deb8u6"]},{"source":"osv","ecosystem":"Mageia:5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-5.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.3"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.3"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2"],"bundled":4}],"products":[{"vendor":"gnu","product":"wget"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/08/27/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/93157","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40824/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://lists.gnu.org/archive/html/bug-wget/2016-08/msg00083.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","evidence"]},{"url":"http://lists.gnu.org/archive/html/bug-wget/2016-08/msg00134.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7098"},{"url":"https://www.exploit-db.com/exploits/40824"},{"url":"https://github.com/advisories/GHSA-57mm-2gj4-2977"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7098","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0323.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18671","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-3012-1","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-09/msg00044.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162358-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/958342","tags":["report"]},{"url":"https://bugzilla.suse.com/984060","tags":["report"]},{"url":"https://bugzilla.suse.com/995964","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7098","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005091","tags":["report"]},{"url":"https://bugzilla.suse.com/1012677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7098","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/08/12/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3464-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3464-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13090","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-06T01:50:47.394Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-7978","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-06T01:50:47Z","updated_at":"2026-11-03T02:22:34.032839Z"}],"ghsa":[{"id":"GHSA-57mm-2gj4-2977","title":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a...","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2022-05-17T01:17:43Z","modified":"2025-04-12T13:05:47Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:01:29.780856Z"}],"nvd":[{"id":"CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T14:59:08.273Z","modified":"2026-06-17T00:52:35.373Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T14:59:08.273Z","modified":"2026-04-16T06:15:15.472704669Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T14:59:08.273Z","modified":"2026-09-22T07:00:51.353770707Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.","status":"published","published":"2016-09-26T00:00:00Z","modified":"2026-02-04T03:26:27.266445Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-2086-1","title":"wget - security update","status":"published","published":"2020-01-29T00:00:00Z","modified":"2026-03-09T01:23:04.965925Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2016-0323","title":"Updated wget packages fix security vulnerability","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by\nredirecting a request from HTTP to a crafted FTP resource (CVE-2016-4971).\n\nFixed a potential race condition by creating files with .tmp ext and\nmaking them accessible to the current user only (CVE-2016-7098).\n","status":"published","published":"2016-09-28T05:59:24Z","modified":"2026-04-16T06:24:46.202021364Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2358-1","title":"Security update for wget","description":"\nThis update for wget fixes the following issues:\n\n- CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed.\n  (bsc#984060).\n\n- CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext\n  and making them accessible to the current user only. (bsc#995964)\n\nBug fixed:\n- Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor\n  (bsc#958342)\n","status":"published","published":"2016-09-23T12:56:12Z","modified":"2026-02-04T03:43:44.342317Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3268-1","title":"Security update for wget","description":"\nThis update for wget fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-7098: Fixed a potential race condition by creating files with .tmp ext\n  and making them accessible to the current user only. (bsc#995964)\n\nNon security issues fixed:\n- bsc#1005091: Don't call xfree() on string returned by usr_error()  \n- bsc#1012677: Add support for enforcing TLSv1.1 and TLSv1.2 (TLS 1.2 support was already present, but it was not enforcable).\n","status":"published","published":"2016-12-23T17:02:33Z","modified":"2026-02-04T03:31:34.692201Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3464-1","title":"wget vulnerabilities","description":"Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget\nincorrectly handled certain HTTP responses. A remote attacker could use\nthis issue to cause Wget to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)\n\nDawid Golunski discovered that Wget incorrectly handled recursive or\nmirroring mode. A remote attacker could possibly use this issue to bypass\nintended access list restrictions. (CVE-2016-7098)\n\nOrange Tsai discovered that Wget incorrectly handled CRLF sequences in\nHTTP headers. A remote attacker could possibly use this issue to inject\narbitrary HTTP headers. (CVE-2017-6508)\n","status":"published","published":"2017-10-26T16:54:04Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}