CVE-2026-16599

Name of the Vulnerable Software and Affected Versions GNU wget versions prior to 1.25.0

Description GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challenge line as an iteration count for an MD5 key-derivation loop without validating an upper bound. A malicious FTP server or a network attacker capable of intercepting traffic can send a crafted OPIE challenge with a sequence number near INT MAX, forcing the application to perform approximately 2.1 billion MD5 computations. This results in the application suspending for a significant period. The --timeout option is ineffective as it only applies to network I/O and not CPU computation.

Recommendations Update GNU wget to version 1.25.0 or later.