Home Search Pricing Get inErrata About

Sign in Sign up

Graph/wget

Component

wget

wget

wget

Node Details

Public graph metadata

Updated5/1/2026

Connections

50 linked nodes

WRITTEN_INLanguage

WRITTEN_INLanguage

SUPPORTSLanguage

CAUSED_BYProblem

u->url (which is built with URL_AUTH_SHOW preserving username:password). Tension: Files with HTTP/FTP basi.

PERTAIN_TODomain

PERTAIN_TODomain

Credential Leakage

PERTAIN_TOProblem

writes the originally-requested URL into the user.xdg.origin.url extended file attribute — wget (versions <= 1.20) when run with --xattr.

PERTAIN_TOProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

PERTAIN_TOSolution

Change set_file_metadata to take struct url* and call url_string(u, URL_AUTH_HIDE). Tension: never persist a URL that was used as a credential carrier without canonicalizing it through an auth-stripping pass. Outcome: This is what upstream did in wget 1.20.1.

PERTAIN_TOProblem

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

PERTAIN_TOProblem

stack buffer overflow when processing HTTP chunked transfer encoding responses — when wget encounters 3xx redirects with chunked bodies. Outcome: This affects the 'skip redirect body' code path.

PERTAIN_TOSolution

Add check after strtol call: `if (remaining_chunk_size < 0) { return false; }`. Tension: negative not validated before use as read() size. Outcome: wget 1.19.2 added validation of chunk size sign.

PERTAIN_TOSolution

The vulnerability requires sanitizing URLs before storing them in extended attributes — extended file attributes (xattr) using the --xattr option. Tension: URLs frequently contain sensitive data such as API keys, authentication tokens, session IDs, OAuth credentials, or authentication credentials.

PERTAIN_TOProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

PERTAIN_TOSolution

The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. — reencode_escapes() (lines 406-449): two-pass size calculation with int arithmetic. Tension: The two-pass algorithm uses char_needs_escaping() which is context-sensitive. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

OCCURS_ONProblem

buffer overflow vulnerability in wget v1.20.1 affecting the internationalized resource identifier (IRI) support — When processing URLs with non-ASCII characters that require character set conversion. Tension: wget's do_conversion() function in src/iri.c incorrectly manages the output buffer size during reallocation, allowing iconv() to write beyond allocated memory. Outcome: The bug manifests when processing internationalized domain names or URLs with characters that expand during UTF-8 encoding.

OCCURS_ONProblem

stack buffer overflow when processing HTTP chunked transfer encoding responses — when wget encounters 3xx redirects with chunked bodies. Outcome: This affects the 'skip redirect body' code path.

OCCURS_INProblem

writes the originally-requested URL into the user.xdg.origin.url extended file attribute — wget (versions <= 1.20) when run with --xattr.

OCCURS_INProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

PROVIDED_BYPackage

PROVIDED_BYPackage

ENRICHESSolution

Add check after strtol call: `if (remaining_chunk_size < 0) { return false; }`. Tension: negative not validated before use as read() size. Outcome: wget 1.19.2 added validation of chunk size sign.

IMPLEMENTATION_OFDomain

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

Information Leak

RELATES_TODomain

C Systems Programming

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

Information Leak

RELATES_TODomain

Hostname Confusion

RELATES_TODomain

Archive Processing

RELATES_TODomain

POSIX Extended File Attributes

RELATES_TODomain

Credential Leakage

RELATES_TODomain

C Systems Programming

RELATES_TODomain

Security / C systems programming

RELATES_TOAlgorithm

AFFECTSRootCause

u->url = url_string(u, URL_AUTH_SHOW) — src/url.c:954.

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

AFFECTSSolution

Change set_file_metadata to take struct url* and call url_string(u, URL_AUTH_HIDE). Tension: never persist a URL that was used as a credential carrier without canonicalizing it through an auth-stripping pass. Outcome: This is what upstream did in wget 1.20.1.

AFFECTSRootCause

The set_file_metadata function in src/xattr.c. Tension: The escnonprint_uri function only escapes non-printable chars but preserves all URL content including credentials. Outcome: url_string(url, URL_AUTH_HIDE) function can reconstruct URLs without credentials, but set_file_metadata doesn't use it.

AFFECTSRootCause

write_xattr_metadata("user.xdg.origin.url", escnonprint_uri(origin_url), fp) — src/xattr.c set_file_metadata.

AFFECTSRootCause

strtol parses a leading '-' chunk size as a negative value, MIN keeps it negative, and fd_read passes it to read()/gnutls_record_recv() as a huge size_t

stack buffer overflow when processing HTTP chunked transfer encoding responses — when wget encounters 3xx redirects with chunked bodies. Outcome: This affects the 'skip redirect body' code path.

AFFECTSSolution

Add check after strtol call: `if (remaining_chunk_size < 0) { return false; }`. Tension: negative not validated before use as read() size. Outcome: wget 1.19.2 added validation of chunk size sign.

AFFECTSSolution

Before adding user-supplied headers at lines 3308-3313, check whether the redirect target host differs from the original request host. Outcome: compare u->host with original_url->host (and port) before calling request_set_user_header, and skip Authorization-type headers if they differ.

AFFECTSRootCause

reencode_escapes uses 'int' for oldlen, newlen, encode_count — The two-pass algorithm uses char_needs_escaping(). Outcome: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release.

AFFECTSRootCause

strpbrk(url, "@/?#;") — ';' in scan set is the bug — for HTTP, init_seps returns ":/?#" (no semicolon since HTTP lacks scm_has_params). Tension: when url_skip_credentials returns the original pointer, host_b includes userinfo+@+hostname as one string. Outcome: The old code conflated per-component delimiters.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

wget - inErrata Knowledge Graph | Inerrata