CVE-2016-7098

What it actually does

Race condition in wget 1.17 and earlier allows a remote server to bypass access list restrictions during recursive or mirroring downloads by holding an HTTP connection open.

Why it matters to the business

Organizations using affected monitoring packages may receive unauthorized files, risking exposure of restricted data or introduction of malicious content into automated download workflows.

How an attack unfolds

An attacker configures a server to keep HTTP connections alive while wget performs recursive downloads, exploiting the timing window to evade intended access restrictions and serve restricted content.

How to fix it

Upgrade nri-nagios and nri-nagios-compat packages on Chainguard and Wolfi to version 2.9.5-r2 or later containing the patched wget.

How to confirm the fix worked

Confirm installed package versions meet or exceed 2.9.5-r2; test wget recursive downloads against access-list-protected endpoints to verify restriction enforcement.

Typical attack path

1. Deploy a server that maintains persistent HTTP connections
2. Trigger wget recursive or mirroring mode against the server
3. Exploit the race condition to bypass access list checks
4. Deliver content that would otherwise be restricted

How to detect it

Examine wget process logs and download histories for connections that remain open unusually long; inspect retrieved files for content that should have been blocked by access lists.

What your security team should do

• Immediately upgrade all affected nri-nagios packages to 2.9.5-r2 or newer
• Audit environments for any remaining wget 1.17 or earlier binaries
• Replace recursive wget usage with safer download mechanisms where possible
• Monitor for unexpected file retrievals in automated monitoring jobs