CVE-2026-58470

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58470
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-58470.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-58470
Downstream
Related
Published
2026-07-07T19:45:53.170Z
Modified
2026-07-24T17:23:07.938982248Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing
Details

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.

Database specific 
{
    "cwe_ids": [
        "CWE-190"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58470.json"
}
References

Affected packages

Git / gitlab.com/gnuwget/wget

Affected ranges

Type
GIT
Repo
https://gitlab.com/gnuwget/wget
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.25.0"
        }
    ],
    "cpe": "cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.12
v1.13
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.14
v1.15
v1.16
v1.16.1
v1.16.2
v1.16.3
v1.17
v1.17.1
v1.18
v1.19
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.20
v1.20.1
v1.20.2
v1.20.3
v1.21
v1.21.1
v1.21.2
v1.21.3
v1.21.4
v1.24.5
v1.25.0

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "138931328250728472567721601526991415512",
            "length": 1001.0
        },
        "target": {
            "function": "parse_content_range",
            "file": "src/http.c"
        },
        "id": "CVE-2026-58470-5da096f5",
        "source": "https://gitlab.com/gnuwget/wget@43d3ba9336bc94937e6fae2365c6ffd30c34ffcf",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/http.c"
        },
        "digest": {
            "line_hashes": [
                "177219757112815876172651596089604524191",
                "200694856994699943861914894742874343656",
                "123398034657310350205332809495302491471",
                "181430112084156403613697920357366166981",
                "133226649428859216319326870664074668851",
                "283003765506202041659779981474651028961",
                "132243660669146413245376551272486911533",
                "222424315619232159047284449067599240748",
                "272589537221866102618184422786554688771",
                "113623243825161525834071406541257934707",
                "227168606285830845366411063380320633346",
                "283044923262720583704432870131943624351",
                "157385620681826442664309504662064386029",
                "61865467713952617533999824284009096677",
                "204733200584370020931263889397556640395",
                "50245998155124680166036232576489737067",
                "38816684614576521746573751991691924665",
                "243009189228695392445665105935667586106",
                "260132529258356535783997526643187026162",
                "177257172127538207397477126696212213578",
                "177445071276302720867556083763198537821",
                "41106224854724948422932210844551721678",
                "297395446576198419442995137992662337317",
                "172160540955050173204047386772573121838",
                "250729210405314450111523036066788377437",
                "4251081327117354464421554705391033828",
                "35149065455449082186389032198764379534",
                "183165315574734178376355590055291046056"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-58470-a4d92d2c",
        "source": "https://gitlab.com/gnuwget/wget@43d3ba9336bc94937e6fae2365c6ffd30c34ffcf",
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-07-15T14:20:31Z"
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-58470.json"