PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-58469 gnuwget CVE debrief

CVE-2026-58469 is a heap buffer underread vulnerability in GNU Wget through 1.25.0. The vulnerability exists in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document containing a whitespace-only URL. This can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior. Users of GNU Wget versions through 1.25.0 should be aware of this vulnerability and take steps to mitigate it.

Vendor
gnuwget
Product
wget
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-07
Original CVE updated
2026-07-07
Advisory published
2026-07-07
Advisory updated
2026-07-07

Who should care

Users of GNU Wget versions through 1.25.0 should be aware of this vulnerability and take steps to mitigate it. This includes updating to a version of GNU Wget that includes the fix, such as the version that includes commit 37a40fc. Additionally, users should be cautious when downloading files from untrusted sources, as a malicious server can exploit this vulnerability to trigger memory corruption. Security teams and operators managing GNU Wget deployments should prioritize mitigation.

Technical summary

The clean_metalink_string() function in src/metalink.c of GNU Wget through 1.25.0 is vulnerable to a heap buffer underread. When processing a Metalink document with a whitespace-only URL, the function can decrement a pointer past the start of the buffer. This can lead to memory corruption and potentially abnormal program behavior. The issue was fixed in commit 37a40fc. Affected users should update to a version of GNU Wget that includes this fix. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity.

Defensive priority

High

Recommended defensive actions

  • Update GNU Wget to a version that includes the fix, such as the version that includes commit 37a40fc.
  • Be cautious when downloading files from untrusted sources.
  • Monitor for and apply patches or updates from the vendor.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-07T21:17:28.383Z and has not been modified since then. The NVD entry is currently Received. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. Evidence is limited to CVE and NVD details. Defenders should verify affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T21:17:28.383Z and has not been modified since then. The NVD entry is currently Received.