{"id":"CVE-2026-16599","aliases":["BELL-CVE-2026-16599","DEBIAN-CVE-2026-16599","EUVD-2026-65494","GHSA-48r3-mr49-jp8x","MGASA-2026-0386","OESA-2026-3766","OESA-2026-3767","OESA-2026-3768","OESA-2026-3769","OESA-2026-3910","SUSE-SU-2026:23455-1","SUSE-SU-2026:23520-1","SUSE-SU-2026:23975-1","SUSE-SU-2026:23991-1","SUSE-SU-2026:4049-1","SUSE-SU-2026:4053-1","SUSE-SU-2026:4074-1","UBUNTU-CVE-2026-16599","openSUSE-SU-2026:11646-1","openSUSE-SU-2026:22011-1"],"status":"published","title":"Denial of Service in GNU wget","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00375,"percentile":0.31746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-606"],"published":"2026-08-25T14:17:04Z","modified":"2026-10-28T11:07:47Z","fixes":[{"ecosystem":"Alpaquita:23","package":"wget","fixed_in":["1.21.4-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"wget","fixed_in":["1.25.0-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"wget","fixed_in":["1.25.0-r3"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"wget","fixed_in":["1.25.0-2.3.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"wget","fixed_in":["1.21.4-1.5.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","fixed_in":["1.20.3-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"wget","fixed_in":["1.21.2-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"wget","fixed_in":["1.21.4-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"wget","fixed_in":["1.21.4-5.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"wget","fixed_in":["1.21.4-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"wget","fixed_in":["1.24.5-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"wget","fixed_in":["1.24.5-slfo.1.1_6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"wget","fixed_in":["1.25.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wget","fixed_in":["1.25.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wget","fixed_in":["1.25.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wget","fixed_in":["1.24.5-150700.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","fixed_in":["1.20.3-150000.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"wget","fixed_in":["1.14-21.31.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wget","fixed_in":["1.25.0-7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"wget","fixed_in":["1.25.0-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r2"},{"fixed":"1.21.4-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0-r1"},{"fixed":"1.25.0-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r2"},{"fixed":"1.25.0-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-1","1.21.3-1+deb12u1","1.21.4-1","1.24.5-1","1.24.5-2","1.25.0-1","1.25.0-2","1.25.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-2","1.25.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-2","1.25.0-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-2.3.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1.5.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-5.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-slfo.1.1_6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-150700.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3","1.15-1ubuntu1.14.04.4","1.15-1ubuntu1.14.04.5","1.15-1ubuntu1.14.04.5+esm2","1.15-1ubuntu1.14.04.5+esm3","1.15-1ubuntu1.14.04.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4","1.17.1-1ubuntu1.5","1.17.1-1ubuntu1.5+esm1","1.17.1-1ubuntu1.5+esm3","1.17.1-1ubuntu1.5+esm4","1.17.1-1ubuntu1.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1","1.19.4-1ubuntu2.2","1.19.4-1ubuntu2.2+esm1","1.19.4-1ubuntu2.2+esm3","1.19.4-1ubuntu2.2+esm4","1.19.4-1ubuntu2.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu1","1.20.3-1ubuntu2","1.20.3-1ubuntu2.1","1.20.3-1ubuntu2.1+esm2","1.20.3-1ubuntu2.1+esm3","1.20.3-1ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu3","1.21-1ubuntu4","1.21-1ubuntu5","1.21.2-2ubuntu1","1.21.2-2ubuntu1.1","1.21.2-2ubuntu1.3","1.21.2-2ubuntu1.4","1.21.2-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-1ubuntu1","1.21.4-1ubuntu1","1.21.4-1ubuntu2","1.21.4-1ubuntu3","1.21.4-1ubuntu4","1.21.4-1ubuntu4.1","1.21.4-1ubuntu4.3","1.21.4-1ubuntu4.4","1.21.4-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-2ubuntu4","1.25.0-2ubuntu6","1.25.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-2ubuntu3","1.25.0-2ubuntu4","1.25.0-2ubuntu4.2","1.25.0-2ubuntu4.3","1.25.0-2ubuntu4.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-160000.4.1"}]}]}],"products":[{"vendor":"gnu","product":"wget"}],"references":[{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-16599","tags":["third-party-advisory","advisory"]},{"url":"https://gitlab.com/gnuwget/wget","tags":["product","package"]},{"url":"https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16599","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-48r3-mr49-jp8x"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-16599","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16599.json","tags":["advisory"]},{"url":"https://gitlab.com/gnuwget/wget/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-16599","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0386.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36252","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QHO3CCUMDDJMZO4R4WSN3NU5L4OBEURT/","tags":["web"]},{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-16599/","tags":["advisory","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3766","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3767","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3768","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3769","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3910","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623455-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16599","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623520-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623975-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623991-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264049-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264053-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264074-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-16599","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16599","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-16599","title":"Denial of Service in GNU wget","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T14:17:04.941Z","modified":"2026-08-25T14:51:53.738Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-65494","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T14:17:04Z","modified":"2026-08-25T14:51:53Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.944243Z"}],"ghsa":[{"id":"GHSA-48r3-mr49-jp8x","title":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality....","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T15:33:00Z","modified":"2026-08-25T15:33:06Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T15:10:57.434403Z"}],"nvd":[{"id":"CVE-2026-16599","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T15:16:30.34Z","modified":"2026-08-28T15:26:19.533Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"CVE-2026-16599","title":"Denial of Service in GNU wget","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T14:17:04.941Z","modified":"2026-10-28T11:07:47.00377318Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-16599","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.   This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T15:16:30.34Z","modified":"2026-10-01T03:02:52.237582246Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"OESA-2026-3766","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\n\nGNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)","status":"published","published":"2026-09-14T16:34:07Z","modified":"2026-09-13T16:45:35.55448321Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3767","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\n\nGNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)","status":"published","published":"2026-09-14T16:34:08Z","modified":"2026-09-13T16:45:35.554444842Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3768","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\n\nGNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)","status":"published","published":"2026-09-14T16:34:09Z","modified":"2026-09-13T16:45:35.553139928Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3769","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\n\nGNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)","status":"published","published":"2026-09-14T16:34:09Z","modified":"2026-09-13T16:45:37.419712915Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3910","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\n\nGNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.(CVE-2026-16599)","status":"published","published":"2026-09-20T13:23:08Z","modified":"2026-09-20T13:30:25.210774114Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-16599","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa","status":"published","published":"2026-08-25T15:16:00Z","modified":"2026-10-17T12:58:06.361961658Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"BELL-CVE-2026-16599","status":"published","published":"2026-08-29T06:03:53.10839Z","modified":"2026-09-12T07:15:04.441480763Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"MGASA-2026-0386","title":"Updated wget packages fix a security vulnerability","description":"Denial of Service in GNU wget. (CVE-2026-16599)\n","status":"published","published":"2026-09-09T18:01:33Z","modified":"2026-09-09T18:15:05.194094548Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11646-1","title":"wget-1.25.0-7.1 on GA media","description":"These are all security issues fixed in the wget-1.25.0-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-29T00:00:00Z","modified":"2026-08-30T13:00:03.96982807Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22011-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-10-01T12:43:37Z","modified":"2026-10-03T17:23:11.632898166Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23455-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-09-04T08:39:53Z","modified":"2026-09-14T18:23:11.871031902Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23520-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-09-04T09:08:38Z","modified":"2026-09-15T18:23:08.973820802Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23975-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-10-01T12:39:28Z","modified":"2026-10-06T17:23:08.943300114Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23991-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-10-01T12:39:28Z","modified":"2026-10-06T17:23:09.879605003Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4049-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-09-07T13:54:40Z","modified":"2026-09-13T18:23:18.258163393Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4053-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-09-07T15:47:29Z","modified":"2026-09-13T18:23:18.758771168Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4074-1","title":"Security update for wget","description":"This update for wget fixes the following issue:\n\n- CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE (bsc#1276962).\n","status":"published","published":"2026-09-08T07:09:59Z","modified":"2026-09-13T18:23:19.96077677Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}