🛡️ MGASA-2026-0300 — wget

Updated wget packages fix security vulnerabilities

Updated wget packages fix security vulnerabilities:

-CVE-2026-58469 Wget incorrectly handled Metalink documents containing

a whitespace-only URL. A remote attacker could possibly use this issue

to cause a denial of service. This issue only affected Mageia 9 and

Mageia 10.

-CVE-2026-58470 : Wget incorrectly handled Content-Range header values,

leading to an integer overflow. A remote attacker could possibly use

this issue to cause download desynchronization.

-CVE-2026-58471 : Wget incorrectly handled character set conversion of

server-supplied filenames. A remote attacker could possibly use this

issue to cause a denial of service or possibly execute arbitrary code.

This issue affected Mageia9 and Mageia 10.

-CVE-2026-58472: It was discovered that Wget incorrectly handled HTML

attributes requiring entity encoding. A remote attacker could possibly

use this issue to cause a denial of service or possibly execute

arbitrary code.

-CVE-2026-15146: GNU Wget did not validate the IP address provided by an

FTP PASV response while operating in FTP passive mode. A malicious FTP

server, or an HTTP server that redirects to an FTP URL, could exploit

this behavior to redirect Wget's data connection to an arbitrary

IP address and port.

This allowed an attacker to forge server-side requests (SSRF) from the

machine running Wget, potentially accessing localhost services or

internal network resources.