Thank you very much for the report(s), Tristan!#3 has been reported privately earlier (including a patch). The patch has been merged today.
#1, #2, #4 have been fixed in master today (please take this as acknowledgement for your findings).
Regards, Tim On 6/27/26 00:06, Tristan wrote:
Hello, I am writing to report 4 memory safety vulnerabilities in GNU Wget 1.25.0, all confirmed present at master HEAD on GNU Savannah (2026-06-20). These cover the Metalink URL parser, HTTP Content-Range header handling, iconv filename conversion, and HTML link conversion. Summary of findings: 1. Heap buffer underread in clean_metalink_string() -- crash (CVSS 7.5) 2. Signed integer overflow in parse_content_range() -- UB/desync (CVSS 5.3) 3. Heap buffer overflow in convert_fname() iconv E2BIG handler (CVSS 6.1) 4. Integer overflow in html_quote_string() size counter (CVSS 5.9) Findings #1 and #2 are triggered by a malicious server without user interaction beyond initiating the download. Finding #3 requires --remote-encoding or IRI mode. Finding #4 requires recursive download with --convert-links and a very large HTML attribute. All 4 have been lab-verified with AddressSanitizer and/or UndefinedBehaviorSanitizer. Individual details are attached. I would appreciate an acknowledgment of receipt and CVE assignment for each confirmed finding. Thank you and please let me know if you need anything else. Regards, Tristan
OpenPGP_signature.asc
Description: OpenPGP digital signature
