CVE-2026-58469

A flaw was found in GNU Wget. A malicious server could exploit a heap buffer underread vulnerability by providing a specially crafted Metalink document containing a URL with only whitespace characters. This could lead to memory corruption and abnormal program behavior, potentially causing a denial of service.

Moderate: A heap-buffer-underread in GNU Wget's clean_metalink_string() function, affecting Red Hat Enterprise Linux 8, can be triggered when wget processes a specially crafted Metalink document containing a resource URL consisting only of whitespace characters. This code path is only reachable when Wget's Metalink support is explicitly requested via --input-metalink or --metalink-over-http; it is not exercised during ordinary downloads. Successful exploitation requires a user to invoke Wget's Metalink handling against an attacker-controlled or compromised server. The out-of-bounds byte is read only to decide whether to continue a trim loop and is never returned, logged, or written -- the practical impact is limited to a crash of the wget process (denial of service), not memory corruption or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using Wget's Metalink options (--input-metalink and --metalink-over-http) when downloading from untrusted or unverified servers. Since Metalink processing must be explicitly requested, omitting these options avoids the vulnerable code path entirely.