GNU wget FTP OPIE flaw enables DoS
A malicious FTP server or MITM attacker can trigger a CPU-exhaustion DoS in GNU wget via an unbounded OPIE/S-KEY MD5 iteration count.
CERT Polska coordinated disclosure of CVE-2026-16599, a denial-of-service vulnerability in GNU wget's FTP OPIE/S-KEY authentication handling. The flaw arises because the sequence number supplied by the FTP server in the challenge line is used directly as an iteration count for an MD5 key-derivation loop without any upper bound check. A malicious or attacker-controlled FTP server, or a network attacker positioned to intercept and modify FTP traffic, can send a crafted OPIE challenge with a sequence number close to INT_MAX, forcing the client to perform roughly 2.1 billion MD5 computations, effectively hanging the wget process.
Notably, the commonly used --timeout option does not mitigate this issue since it only governs network I/O timeouts and not CPU-bound computation, meaning affected clients can be stalled indefinitely regardless of that mitigation. The issue was reported by researchers Michał Majchrowicz and Marcin Wyczechowski of AFINE Team and has been fixed upstream in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa. Defenders using wget for automated FTP interactions, especially against untrusted or third-party servers, should update to the patched version and consider restricting or monitoring FTP client usage where feasible.
This is a low-complexity, low-impact availability issue rather than a code-execution or data-disclosure flaw; there is no indication of in-the-wild exploitation, and impact is limited to resource exhaustion/hang of the wget client process.
Mentioned in this report
Detection guidance
wget Process High CPU Usage During FTP Authentication
Detects wget process consuming abnormally high CPU for extended duration during FTP session, indicative of MD5 iteration loop exploitation in OPIE/S-KEY challenge handling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: wget Process High CPU Usage During FTP Authentication
description: Detects wget consuming sustained high CPU during FTP authentication phase,
typical of CVE-2026-16599 OPIE iteration-count DoS. The flaw forces expensive MD5
key-derivation with INT_MAX-range iteration counts, stalling the process. Legitimate
FTP auth completes in milliseconds; hang lasting >30 seconds with >80% CPU suggests
exploitation.
tags:
- attack.t1499
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: wget.exe
CommandLine|contains: ftp://
filter_legitimate:
CommandLine|contains:
- --timeout
- --connect-timeout
condition: selection and not filter_legitimate
falsepositives:
- Legitimate large FTP file transfers with slow network
- wget performing legitimate OPIE-authenticated transfers against trusted FTP servers
level: medium
id: 63ae6321-1892-5fae-b943-f8028b3fcc92
status: experimental
author: Vorant
wget Process Unresponsive with FTP Connection Hanging
Detects wget FTP client process hanging unresponsively with active FTP session despite --timeout flag, consistent with CPU-bound MD5 iteration loop in OPIE challenge handling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: wget Process Unresponsive with FTP Connection Hanging
description: Detects wget.exe process in hung state with open FTP connection (port
21 inbound), unresponsive for >60 seconds despite timeout flags, indicative of CVE-2026-16599
iteration-count DoS. The flaw bypasses --timeout since it is network-I/O-only and
does not cap CPU-bound computation.
tags:
- attack.t1499
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: wget.exe
CommandLine|contains: --timeout
condition: selection
falsepositives:
- Network congestion causing legitimate slow FTP transfers
- Legitimate resumable downloads with intentional long waits
level: low
id: 882762ca-8b62-5eca-8f3e-9100bebb2749
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-16599
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free