CVE-2026-58470

An integer overflow in GNU Wget's parse_content_range() function allows malicious servers to send crafted Content-Range headers. This triggers undefined behavior and download desynchronization, potentially causing a denial of service or data integrity issues for the client.

Moderate: GNU Wget is vulnerable to a client-side integer overflow in its Content-Range header processing. If a client connects to an attacker-controlled server, the server can return anomalous headers that cause undefined behavior and stream desynchronization. This results in local data integrity issues or a denial of service, though the impact is strictly limited to the Wget process itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid using wget to download content from untrusted or unverified sources. When wget is used in automated scripts or environments, ensure that the target servers are trusted to prevent exposure to malicious Content-Range headers. Restricting network access for wget to only trusted hosts can also reduce the attack surface.