Denial of Service Vulnerability in GNU Wget FTP Authentication

CVE-2026-16599

What is CVE-2026-16599?

GNU Wget is susceptible to a denial of service attack that arises from its FTP OPIE/S-KEY authentication process. Specifically, the vulnerability stems from a lack of upper bound validation on the server-supplied sequence number derived from the FTP challenge line. This flaw permits an attacker, either through a malicious FTP server or intercepted FTP traffic, to present a specially crafted OPIE challenge containing a sequence number close to INT_MAX. As a result, Wget may perform an excessive number of MD5 computations—approximately 2.1 billion—exposing users to significant performance degradation. Notably, the --timeout option does not alleviate this concern since it is limited to network I/O rather than CPU-intensive operations.

References