GNU wget FTP OPIE flaw enables DoS
A malicious FTP server or MITM attacker can trigger a CPU-exhaustion DoS in GNU wget via an unbounded OPIE/S-KEY MD5 iteration count.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-16599, a denial-of-service vulnerability in GNU wget's FTP OPIE/S-KEY authentication handling. The flaw arises because the sequence number supplied by the FTP server in the challenge line is used directly as an iteration count for an MD5 key-derivation loop without any upper bound check. A malicious or attacker-controlled FTP server, or a network attacker positioned to intercept and modify FTP traffic, can send a crafted OPIE challenge with a sequence number close to INT_MAX, forcing the client to perform roughly 2.1 billion MD5 computations, effectively hanging the wget process.
Notably, the commonly used --timeout option does not mitigate this issue since it only governs network I/O timeouts and not CPU-bound computation, meaning affected clients can be stalled indefinitely regardless of that mitigation. The issue was reported by researchers Michał Majchrowicz and Marcin Wyczechowski of AFINE Team and has been fixed upstream in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa. Defenders using wget for automated FTP interactions, especially against untrusted or third-party servers, should update to the patched version and consider restricting or monitoring FTP client usage where feasible.
This is a low-complexity, low-impact availability issue rather than a code-execution or data-disclosure flaw; there is no indication of in-the-wild exploitation, and impact is limited to resource exhaustion/hang of the wget client process.
Mentioned in this report
Detection guidance
wget Process High CPU Usage During FTP Authentication
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects wget process consuming abnormally high CPU for extended duration during FTP session, indicative of MD5 iteration loop exploitation in OPIE/S-KEY challenge handling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: wget Process High CPU Usage During FTP Authentication
description: Detects wget consuming sustained high CPU during FTP authentication phase,
typical of CVE-2026-16599 OPIE iteration-count DoS. The flaw forces expensive MD5
key-derivation with INT_MAX-range iteration counts, stalling the process. Legitimate
FTP auth completes in milliseconds; hang lasting >30 seconds with >80% CPU suggests
exploitation.
tags:
- attack.t1499
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: wget.exe
CommandLine|contains: ftp://
filter_legitimate:
CommandLine|contains:
- --timeout
- --connect-timeout
condition: selection and not filter_legitimate
falsepositives:
- Legitimate large FTP file transfers with slow network
- wget performing legitimate OPIE-authenticated transfers against trusted FTP servers
level: medium
id: 63ae6321-1892-5fae-b943-f8028b3fcc92
status: experimental
author: Vorant
wget Process Unresponsive with FTP Connection Hanging
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects wget FTP client process hanging unresponsively with active FTP session despite --timeout flag, consistent with CPU-bound MD5 iteration loop in OPIE challenge handling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: wget Process Unresponsive with FTP Connection Hanging
description: Detects wget.exe process in hung state with open FTP connection (port
21 inbound), unresponsive for >60 seconds despite timeout flags, indicative of CVE-2026-16599
iteration-count DoS. The flaw bypasses --timeout since it is network-I/O-only and
does not cap CPU-bound computation.
tags:
- attack.t1499
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: wget.exe
CommandLine|contains: --timeout
condition: selection
falsepositives:
- Network congestion causing legitimate slow FTP transfers
- Legitimate resumable downloads with intentional long waits
level: low
id: 882762ca-8b62-5eca-8f3e-9100bebb2749
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-16599
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs