CVE-2026-16599

The record

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa

Affected packages

Related vulnerabilities

• CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. CWE-606
• CVE-2026-85730 smol-toml is a small, fast, and correct TOML parser and serializer. CWE-606
• CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of… CWE-606
• CVE-2026-62901 Unchecked input for loop condition in .NET allows an unauthorized attacker to deny… CWE-606
• CVE-2026-71439 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… CWE-606
• CVE-2026-33800 An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe)… CWE-606
• CVE-2026-15172 FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16… CWE-606
• CVE-2026-11972 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the… CWE-606