Skip to content
Fencer Vulns
critical 9.8

CVE-2019-5953 json

Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code…

published 2019-05-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15521

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.9%
EPSS 5.9% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

Patch / fix

  • wget Debian 14, Debian 13, Debian 12 1.20.1-1.1

debian advisories DEBIAN-CVE-2019-5953

  • wget Ubuntu 14.04 LTS 1.15-1ubuntu1.14.04.5
  • wget Ubuntu 16.04 LTS 1.17.1-1ubuntu1.5
  • wget Ubuntu 18.04 LTS 1.19.4-1ubuntu2.2

ubuntu advisories UBUNTU-CVE-2019-5953

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wget RHEL 8 1.19.5-7.el8_0.1
  • wget RHEL 7 1.14-18.el7_6.1
  • wget RHEL 7.4 TUS, RHEL 7.4 E4S, RHEL 7.4 AUS 1.14-15.el7_4.2
  • wget RHEL 7.5 EUS 1.14-16.el7_5.1

red hat advisories RHSA-2019:3168RHSA-2019:2979RHSA-2019:0983RHSA-2019:1228

  • wget SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +11 more 1.14-21.10.1
  • wget SLE Module for Basesystem 15 1.19.5-3.6.2

suse advisories SUSE-SU-2019:0956-1SUSE-SU-2019:0925-1

  • wget openSUSE Tumbleweed 1.21.1-2.2
  • wget openSUSE Leap 15.0 1.19.5-lp150.7.1

opensuse advisories openSUSE-SU-2024:11510-1openSUSE-SU-2019:1236-1

  • wget Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.20.3-r0

alpine advisories ALPINE-CVE-2019-5953

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-5953 updated cvss 8.8

wget: do_conversion() heap-based buffer overflow vulnerability

  • Red Hat Enterprise Linux AppStream (v. 8) wget 1.19.5-7.el8_0.1
    fixed: vendor fix RHSA-2019:0983
  • Red Hat Enterprise Linux Client (v. 7) wget 1.14-18.el7_6.1 Red Hat Enterprise Linux ComputeNode (v. 7) wget 1.14-18.el7_6.1
    fixed: vendor fix RHSA-2019:1228
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) wget 1.14-16.el7_5.1
    fixed: vendor fix RHSA-2019:2979
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) wget 1.14-18.el7_6.1 Red Hat Enterprise Linux Server (v. 7) wget 1.14-18.el7_6.1
    fixed: vendor fix RHSA-2019:1228
  • Red Hat Enterprise Linux Server AUS (v. 7.4) wget 1.14-15.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) wget 1.14-15.el7_4.2
    fixed: vendor fix RHSA-2019:3168
  • Red Hat Enterprise Linux Server EUS (v. 7.5) wget 1.14-16.el7_5.1
    fixed: vendor fix RHSA-2019:2979
  • Red Hat Enterprise Linux Server TUS (v. 7.4) wget 1.14-15.el7_4.2
    fixed: vendor fix RHSA-2019:3168
  • Red Hat Enterprise Linux Workstation (v. 7) wget 1.14-18.el7_6.1
    fixed: vendor fix RHSA-2019:1228
show 1 more
  • Red Hat Enterprise Linux 5 wget Red Hat Enterprise Linux 6 wget
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.86% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • The GNU Projec GNU Wget

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.