PT-2026-81317
CVE-2026-16599
·
Published
2026-08-25
·
Updated
2026-10-01
Description by
CVSS 4.0
5.1
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
GNU wget versions prior to 1.25.0
Description
GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challenge line as an iteration count for an MD5 key-derivation loop without validating an upper bound. A malicious FTP server or a network attacker capable of intercepting traffic can send a crafted OPIE challenge with a sequence number near
INT MAX, forcing the application to perform approximately 2.1 billion MD5 computations. This results in the application suspending for a significant period. The --timeout option is ineffective as it only applies to network I/O and not CPU computation.Recommendations
Update GNU wget to version 1.25.0 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾