CVE-2026-16599— Denial of Service in GNU wget
Quick assessment
Affected
GNU wget
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GNU wget 在其 FTP OPIE/S-KEY 认证功能中存在拒绝服务（DoS）漏洞。该漏洞源于服务器提供的序列号被直接用作 MD5 密钥派生循环的迭代次数，且未设置任何上限验证。恶意 FTP 服务器或能够拦截 FTP 流量的网络攻击者可以构造一个包含接近 INT_MAX 值的序列号的 OPIE 挑战报文，从而导致 wget 执行多达约 21 亿次 MD5 计算，并长时间挂起。由于 --timeout 选项仅适用于网络 I/O 超时，而不适用于 CPU 计算耗时，因此无法缓解此问题。 此问题已在提交 e969
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of Service in GNU wget
Source: CVE Program / CVE List V5
Vulnerability Description
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
循环条件输入未经检查
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-16599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16599
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-16599 (1)
Security Blog Posts for CVE-2026-16599 (1)
-
🔗 Vulnerability in GNU wget software | CERT Polska third-party-advisory
Other References for CVE-2026-16599 (1)
-
🔗 Wget / wget · GitLab product
IV. Related Vulnerabilities
Same product: wget
-
CVE-2026-15146
CVE-2026-15146 -
CVE-2026-58472
GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Enco -
CVE-2026-58471
GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in -
CVE-2026-58470
GNU Wget 1.25.0 Integer Overflow via Content-Range Header Pa -
CVE-2026-58469
GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsi
Same vendor: GNU
-
CVE-2026-77219
GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loa -
CVE-2026-66486
Improper Output Encoding in GNU cpio -
CVE-2026-66485
Uncontrolled Memory Allocation in GNU cpio -
CVE-2026-66484
Path Traversal in GNU cpio -
CVE-2026-71394
Heap Use of Uninitialized Memory in GNU Emacs for Android
Same weakness: CWE-606
-
CVE-2026-62901
.NET Denial of Service Vulnerability -
CVE-2026-71439
Mermaid radar diagrams are vulnerable to DoS -
CVE-2026-20301
Cisco IOS Software and IOS XE Software Extensible Messaging -
CVE-2026-67554
Apache Qpid Proton Dotnet: Unbounded disposition range handl -
CVE-2026-68077
Apache Qpid Broker-J: Unbounded disposition range handling c
V. Comments for CVE-2026-16599
No comments yet