Skip to content
Fencer Vulns
high 8.8

CVE-2017-13090 in the critical feed json

GNU Wget: heap overflow in HTTP protocol handling

published 2017-10-27 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4608

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
36.6%
EPSS 36.6% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.

Patch / fix

  • wget Debian 14, Debian 13, Debian 12 1.19.2-1

debian advisories DEBIAN-CVE-2017-13090

  • wget Ubuntu 14.04 LTS 1.15-1ubuntu1.14.04.3
  • wget Ubuntu 16.04 LTS 1.17.1-1ubuntu1.3

ubuntu advisories UBUNTU-CVE-2017-13090

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wget RHEL 7 1.14-15.el7_4.1

red hat advisories RHSA-2017:3075

  • wget SLES for Raspberry Pi 12 SP2, SLES 12 SP3, SLES 12 SP2 +8 more 1.14-21.3.1

suse advisories SUSE-SU-2017:2871-2SUSE-SU-2017:2871-1

  • wget openSUSE Tumbleweed 1.21.1-2.2

opensuse advisories openSUSE-SU-2024:11510-1

  • wget Alpine 3.24, Alpine 3.23, Alpine 3.22 +16 more 1.19.2-r0
  • wget Alpine 3.4 1.18-r2
  • wget Alpine 3.5 1.18-r3

alpine advisories ALPINE-CVE-2017-13090

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wget Arch Linux 1.19.2-1

arch linux advisories AVG-473

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-13090 updated cvss 7.8

wget: Heap-based buffer overflow in HTTP protocol handling

  • Red Hat Enterprise Linux Client (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux ComputeNode (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux Server (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux Workstation (v. 7) wget 1.14-15.el7_4.1
    fixed: vendor fix RHSA-2017:3075
  • Red Hat Enterprise Linux 5 wget Red Hat Enterprise Linux 6 wget
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

36.56% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • GNU Project Wget

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.