{"id":"CVE-2017-13089","aliases":["ALPINE-CVE-2017-13089","DEBIAN-CVE-2017-13089","DLA-1149-1","DSA-4008-1","EUVD-2017-4607","GHSA-3737-prh2-4m4p","MGASA-2017-0396","RHSA-2017:3075","SUSE-SU-2017:2871-1","SUSE-SU-2017:2871-2","UBUNTU-CVE-2017-13089","USN-3464-1","openSUSE-SU-2024:11510-1"],"status":"published","title":"GNU Wget: stack overflow in HTTP protocol handling","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.79855,"percentile":0.99612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119","CWE-121"],"published":"2017-10-26T15:00:00Z","modified":"2026-11-01T10:45:38Z","exploits":[{"source":"pocgithub","id":"r1b/CVE-2017-13089","title":"r1b/CVE-2017-13089","date":"2017-10-27","url":"https://github.com/r1b/CVE-2017-13089"},{"source":"pocgithub","id":"mzeyong/CVE-2017-13089","title":"mzeyong/CVE-2017-13089","date":"2017-11-15","url":"https://github.com/mzeyong/CVE-2017-13089"}],"fixes":[{"ecosystem":"Alpine:v3.4","package":"wget","fixed_in":["1.18-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"wget","fixed_in":["1.18-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.19.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wget","fixed_in":["1.15-1ubuntu1.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wget","fixed_in":["1.17.1-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-3+deb7u5"}]}],"versions":["1.13.4-3","1.13.4-3+deb7u1","1.13.4-3+deb7u2","1.13.4-3+deb7u3","1.13.4-3+deb7u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-1+deb8u4"}]}],"versions":["1.16-1","1.16-1+deb8u1","1.16-1+deb8u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-5+deb9u1"}]}],"versions":["1.18-5"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-5.3.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-15.el7_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.3"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.3"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-2.2"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"wget"},{"vendor":"gnu project","product":"wget"}],"references":[{"url":"https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","article","report"]},{"url":"https://security.gentoo.org/glsa/201711-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.debian.org/security/2017/dsa-4008","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_62_Wget","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/101592","tags":["vdb-entry","x_refsource_BID","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://github.com/r1b/CVE-2017-13089","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securitytracker.com/id/1039661","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3075","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13089","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3737-prh2-4m4p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-13089","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-13089","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0396.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21947","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505445","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3075.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13089","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13090","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172871-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1064715","tags":["report"]},{"url":"https://bugzilla.suse.com/1064716","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172871-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-13089","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3464-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3464-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13090","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5953","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-13089","title":"GNU Wget: stack overflow in HTTP protocol handling","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:00:00Z","modified":"2024-09-17T01:15:49.128Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-4607","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:00:00Z","modified":"2024-09-17T01:15:49Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:51.722495Z"}],"ghsa":[{"id":"GHSA-3737-prh2-4m4p","title":"The http.c:skip_short_body() function is called in some circumstances, such as when processing...","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2022-05-14T04:01:33Z","modified":"2025-04-20T03:47:47Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-121"],"updated_at":"2026-11-02T15:01:54.559627Z"}],"nvd":[{"id":"CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:29:00.33Z","modified":"2026-06-17T01:04:31.357Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-119"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"ALPINE-CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:29:00.33Z","modified":"2026-06-15T18:24:13.98733619Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:29:00.33Z","modified":"2026-11-08T02:31:08.460744588Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T02:57:37.868817Z"},{"id":"DEBIAN-CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-27T19:29:00.33Z","modified":"2026-09-01T20:03:43.08420361Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"RHSA-2017:3075","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T00:49:54Z","modified":"2026-07-01T10:02:57Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.","status":"published","published":"2017-10-26T15:00:00Z","modified":"2026-02-04T02:40:05.701351Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1149-1","title":"wget - security update","status":"published","published":"2017-10-27T00:00:00Z","modified":"2026-03-09T01:00:53.620541Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4008-1","title":"wget - security update","status":"published","published":"2017-10-28T00:00:00Z","modified":"2026-03-09T02:11:42.871918Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0396","title":"Updated wget packages fix security vulnerabilities","description":"The http.c:skip_short_body() function is called in some circumstances,\nsuch as when processing redirects. When the response is sent chunked,\nthe chunk parser uses strtol() to read each chunk's length, but\ndoesn't check that the chunk length is a non-negative number. The\ncode then tries to skip the chunk in pieces of 512 bytes by using the\nMIN() macro, but ends up passing the negative chunk length to\nconnect.c:fd_read(). As fd_read() takes an int argument, the high\n32 bits of the chunk length are discarded, leaving fd_read() with\na completely attacker controlled length argument (CVE-2017-13089).\n\nThe retr.c:fd_read_body() function is called when processing OK\nresponses. When the response is sent chunked, the chunk parser uses\nstrtol() to read each chunk's length, but doesn't check that the chunk\nlength is a non-negative number. The code then tries to read the chunk\nin pieces of 8192 bytes by using the MIN() macro, but ends up passing\nthe negative chunk length to retr.c:fd_read(). As fd_read() takes an\nint argument, the high 32 bits of the chunk length are discarded,\nleaving fd_read() with a completely attacker controlled length\nargument. The attacker can corrupt malloc metadata after the allocated\nbuffer (CVE-2017-13090).\n","status":"published","published":"2017-10-30T19:23:17Z","modified":"2026-04-16T06:23:38.058725852Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11510-1","title":"wget-1.21.1-2.2 on GA media","description":"These are all security issues fixed in the wget-1.21.1-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:43.041338Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:2871-1","title":"Security update for wget","description":"\n\nThis update for wget fixes the following security issues:\n\n- CVE-2017-13089,CVE-2017-13090: Missing checks for negative remaining_chunk_size in skip_short_body and fd_read_body could\n  cause stack buffer overflows, which could have been exploited by malicious servers. (bsc#1064715,bsc#1064716)\n","status":"published","published":"2017-11-16T10:17:46Z","modified":"2026-02-04T04:39:55.114745Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2871-2","title":"Security update for wget","description":"\n\nThis update for wget fixes the following security issues:\n\n- CVE-2017-13089,CVE-2017-13090: Missing checks for negative remaining_chunk_size in skip_short_body and fd_read_body could\n  cause stack buffer overflows, which could have been exploited by malicious servers. (bsc#1064715,bsc#1064716)\n","status":"published","published":"2017-11-16T10:18:05Z","modified":"2026-02-04T04:09:18.860779Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3464-1","title":"wget vulnerabilities","description":"Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget\nincorrectly handled certain HTTP responses. A remote attacker could use\nthis issue to cause Wget to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)\n\nDawid Golunski discovered that Wget incorrectly handled recursive or\nmirroring mode. A remote attacker could possibly use this issue to bypass\nintended access list restrictions. (CVE-2016-7098)\n\nOrange Tsai discovered that Wget incorrectly handled CRLF sequences in\nHTTP headers. A remote attacker could possibly use this issue to inject\narbitrary HTTP headers. (CVE-2017-6508)\n","status":"published","published":"2017-10-26T16:54:04Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}