Medium [CVE-2026-58469] Memory corruption via crafted Metalink URL
This medium-severity Red Hat Linux advisory covers CVE-2026-58469 affecting Red Hat Enterprise Linux 8, Red Hat package: wget.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL.
Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior. This could lead to memory corruption and abnormal program behavior, potentially causing a denial of service.
Moderate: A heap-buffer-underread in GNU Wget's clean_metalink_string() function, affecting Red Hat Enterprise Linux 8, can be triggered when wget processes a specially crafted Metalink document containing a resource URL consisting only of whitespace characters.
This code path is only reachable when Wget's Metalink support is explicitly requested via --input-metalink or --metalink-over-http; it is not exercised during ordinary downloads. Successful exploitation requires a user to invoke Wget's Metalink handling against an attacker-controlled or compromised server.
The out-of-bounds byte is read only to decide whether to continue a trim loop and is never returned, logged, or written -- the practical impact is limited to a crash of the wget process (denial of service), not memory corruption or code execution.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 10 days ago·verify at source
Mitigation checklist
- Avoid using Wget's Metalink options (--input-metalink and --metalink-over-http) when downloading from untrusted or unverified servers. Since Metalink processing must be explicitly requested, omitting these options avoids the vulnerable code path entirely.
Official advisory · high-confidence parse· fetched 10 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.