PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6508 Gnu CVE debrief

CVE-2017-6508 is a CRLF injection issue in GNU Wget’s URL parsing logic. A crafted URL containing CRLF sequences in the host subcomponent can cause Wget to emit attacker-controlled HTTP headers when making a request. The published CVSS 3.0 score is 6.1 (medium), reflecting network reachability, low attack complexity, no privileges required, but user interaction is needed.

Vendor
Gnu
Product
CVE-2017-6508
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-07
Original CVE updated
2026-05-13
Advisory published
2017-03-07
Advisory updated
2026-05-13

Who should care

Teams that use Wget in automation, scripts, download services, build systems, or any workflow where URLs may come from users, external feeds, or other untrusted inputs. Security and platform teams should also care if Wget is installed broadly on servers or embedded in scheduled jobs.

Technical summary

NVD describes the flaw as a CRLF injection vulnerability in the url_parse function in url.c. The issue affects GNU Wget versions through 1.19.1 and is tracked as CWE-93. Because the host portion of a URL is processed unsafely, an attacker can inject newline-delimited header content into outbound HTTP requests. The CVSS vector supplied by NVD is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that exploitation is network-based, requires user interaction, and can affect confidentiality and integrity at a low level.

Defensive priority

Medium. This is not a KEV-listed issue in the supplied data, but it is externally reachable and can affect request integrity anywhere Wget processes untrusted URLs.

Recommended defensive actions

  • Upgrade GNU Wget to a version newer than 1.19.1 that includes the vendor fix.
  • Treat all URL input to Wget as untrusted and validate or reject CRLF characters before invocation.
  • Avoid passing user-controlled hostnames or full URLs directly into scripts or services that call Wget.
  • Review logs and application code for places where Wget is used to fetch externally supplied resources.
  • If immediate upgrade is not possible, restrict Wget usage to trusted inputs and isolated environments until remediation is complete.

Evidence notes

The debrief is based on the NVD CVE record and the referenced GNU Wget patch and bug-wget mailing list entry. NVD states the vulnerability affects Wget through 1.19.1 and classifies it as CWE-93. The CVE record was published on 2017-03-07; the 2026 modified timestamp reflects later record maintenance and should not be treated as the issue date.

Official resources

Publicly disclosed in the CVE record on 2017-03-07, with NVD references pointing to the GNU patch and related mailing list discussion.