Advisories ยป MGASA-2026-0300

Updated wget packages fix security vulnerabilities

Publication date: 25 Jul 2026
Modification date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58469 , CVE-2026-58470 , CVE-2026-58471 , CVE-2026-58472 , CVE-2026-15146

Description

Updated wget packages fix security vulnerabilities:
-CVE-2026-58469  Wget incorrectly handled Metalink documents containing
 a whitespace-only URL. A remote attacker could possibly use this issue
 to cause a denial of service. This issue only affected Mageia 9 and
 Mageia 10.
-CVE-2026-58470 : Wget incorrectly handled Content-Range header values,
 leading to an integer overflow. A remote attacker could possibly use
 this issue to cause download desynchronization.
-CVE-2026-58471 : Wget incorrectly handled character set conversion of
 server-supplied filenames. A remote attacker could possibly use this
 issue to cause a denial of service or possibly execute arbitrary code.
 This issue affected Mageia9 and Mageia 10.
-CVE-2026-58472: It was discovered that Wget incorrectly handled HTML
 attributes requiring entity encoding. A remote attacker could possibly
 use this issue to cause a denial of service or possibly execute
 arbitrary code.
-CVE-2026-15146: GNU Wget did not validate the IP address provided by an
 FTP PASV response while operating in FTP passive mode. A malicious FTP
 server, or an HTTP server that redirects to an FTP URL, could exploit
 this behavior to redirect Wget's data connection to an arbitrary
 IP address and port.
 This allowed an attacker to forge server-side requests (SSRF) from the
 machine running Wget, potentially accessing localhost services or
 internal network resources.

References

SRPMS

10/core

9/core