CVE-2026-58469

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.25.1

Description A heap buffer underread exists in the clean metalink string() function within src/metalink.c. This occurs when the software processes a Metalink document containing a URL consisting only of whitespace. A malicious server can trigger this by serving a crafted Metalink file, causing the function to decrement a pointer past the start of the allocated buffer. This memory corruption can lead to abnormal program behavior or a denial of service resulting in a crash.

Recommendations Update GNU Wget to the version containing commit 37a40fc.