Skip to content
Fencer Intel
high 8.8

CVE-2017-13089 in the critical feed json

GNU Wget: stack overflow in HTTP protocol handling

published 2017-10-27 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4607

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
79.9%
EPSS 79.9% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.

Patch / fix

  • wget Debian 14, Debian 13, Debian 12 1.19.2-1

debian advisories DEBIAN-CVE-2017-13089

  • wget Ubuntu 14.04 LTS 1.15-1ubuntu1.14.04.3
  • wget Ubuntu 16.04 LTS 1.17.1-1ubuntu1.3

ubuntu advisories UBUNTU-CVE-2017-13089

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wget RHEL 7 1.14-15.el7_4.1

red hat advisories RHSA-2017:3075

  • wget SLES for Raspberry Pi 12 SP2, SLES 12 SP3, SLES 12 SP2 +8 more 1.14-21.3.1

suse advisories SUSE-SU-2017:2871-2SUSE-SU-2017:2871-1

  • wget openSUSE Tumbleweed 1.21.1-2.2

opensuse advisories openSUSE-SU-2024:11510-1

  • wget Alpine 3.4 1.18-r2
  • wget Alpine 3.5 1.18-r3

alpine advisories ALPINE-CVE-2017-13089

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wget Arch Linux 1.19.2-1

arch linux advisories AVG-473

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-13089 updated cvss 7.8

wget: Stack-based buffer overflow in HTTP protocol handling

  • Red Hat Enterprise Linux Client (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux ComputeNode (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux Server (v. 7) wget 1.14-15.el7_4.1 Red Hat Enterprise Linux Workstation (v. 7) wget 1.14-15.el7_4.1
    fixed: vendor fix RHSA-2017:3075
  • Red Hat Enterprise Linux 5 wget Red Hat Enterprise Linux 6 wget
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

79.86% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • GNU Project Wget

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.