Vulnerability record · CVE-2017-13089 · published 27 October 2017
CVE-2017-13089: GNU Wget chunked transfer parser stack buffer overflow
Gnu · Wget
Wget before 1.19.2 fails to validate that a chunk length in a chunked HTTP response is non-negative. A negative length is passed through MIN() to fd_read(), where truncation to int yields an attacker-controlled length, causing a stack-based buffer overflow. Because chunked responses are processed during normal operations such as redirects, a malicious or compromised server can corrupt memory in the client.
Description
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with no privileges required and high EPSS, though exploitation requires the victim to fetch a malicious chunked response.
What it is
Wget before 1.19.2 fails to validate that a chunk length in a chunked HTTP response is non-negative. A negative length is passed through MIN() to fd_read(), where truncation to int yields an attacker-controlled length, causing a stack-based buffer overflow. Because chunked responses are processed during normal operations such as redirects, a malicious or compromised server can corrupt memory in the client.
Impact
An attacker who controls the HTTP response can corrupt stack memory in the wget process, potentially achieving arbitrary code execution in the context of the user running wget. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network via a crafted chunked HTTP response, including during redirect handling; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), meaning the victim must run wget against the attacker-controlled or compromised endpoint.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.79855 (99.59th percentile), and public references include a GitHub repository for the CVE alongside patch and advisory links.
What to do
- Upgrade wget to 1.19.2 or later, or apply the vendor patch referenced in the GNU Savannah commit.
- Apply distribution updates for affected packages (Debian DSA-4008, Red Hat RHSA-2017:3075, Gentoo GLSA 201711-06, Synology SA_17_62).
- Avoid running wget against untrusted or unauthenticated HTTP endpoints where possible.
- Where wget is embedded in appliances or scripts, inventory and update those bundled copies, not just the OS package.
Detection
- Monitor for wget crashes or abnormal process termination when fetching HTTP resources, especially around redirects.
- Inspect network or proxy logs for chunked HTTP responses with malformed or negative chunk-size values reaching wget clients.
- Track wget versions in use across hosts and flag any below 1.19.2.
- Watch for unexpected child processes or outbound connections spawned by wget, which could indicate post-exploitation activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-13089 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-13089), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
