PT-2026-81317
CVE-2026-16599
·
تاريخ النشر
2026-08-25
·
تاريخ التحديث
2026-10-01
الوصف من
CVSS 4.0
5.1
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
GNU wget versions prior to 1.25.0
Description
GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challenge line as an iteration count for an MD5 key-derivation loop without validating an upper bound. A malicious FTP server or a network attacker capable of intercepting traffic can send a crafted OPIE challenge with a sequence number near
INT MAX, forcing the application to perform approximately 2.1 billion MD5 computations. This results in the application suspending for a significant period. The --timeout option is ineffective as it only applies to network I/O and not CPU computation.Recommendations
Update GNU wget to version 1.25.0 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾