CVE-2026-58470

ADVISORY - debian

Summary

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.

wget (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141689) [trixie] - wget (Minor issue) [bookworm] - wget (Minor issue) [bullseye] - wget (Minor issue) Fixed by: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf

EPSS Score⁠: 0.00247 (0.161)

Common Weakness Enumeration (CWE)

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.