Loading story…
CERT Polska disclosed CVE-2026-16599, a denial-of-service vulnerability in GNU Wget affecting all versions through 1.25.0. The flaw is in Wget's FTP OPIE/S-KEY authentication handling, where a server-controlled sequence number is used as the iteration count for an MD5 key-derivation loop without an upper-bound check, a weakness mapped to CWE-606.
A malicious FTP server or an on-path attacker can exploit the bug by sending a crafted OPIE challenge with a sequence number near INT_MAX, causing Wget to perform about 2.1 billion MD5 computations and hang for an extended period. CERT Polska said the --timeout option does not prevent the issue because it limits network I/O rather than CPU-bound work, and reported that the vulnerability was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-25, CERT Polska published CVE-2026-16599, a denial-of-service vulnerability in GNU wget caused by unchecked input used as the loop condition in FTP OPIE/S-KEY authentication. A malicious FTP server or on-path attacker can trigger excessive MD5 computations and hang wget.
The denial-of-service issue in GNU wget's FTP OPIE/S-KEY authentication handling was remediated in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa. The flaw affects versions through 1.25.0.
CERT Polska said it received a responsible vulnerability report for CVE-2026-16599 from Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and coordinated disclosure of the issue affecting GNU wget.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two FTP server products were disclosed with serious buffer overflow vulnerabilities that can be triggered remotely. **Core FTP/SFTP Server 1.2** is affected by `CVE-2019-25654`, a flaw in the **User domain** field where an excessively long string of roughly 7,000 bytes can crash the application and cause a denial of service. The issue is classified as `CWE-120`/buffer overflow behavior with impact focused on availability, and public references include advisories from VulnCheck and Exploit-DB. A separate flaw, `CVE-2018-25254`, affects **NICO-FTP 3.0.1.19** and is described as a remote **SEH buffer overflow** reachable through crafted FTP commands containing oversized data. The vulnerability allows unauthenticated attackers to overwrite exception handler pointers and potentially execute injected shellcode, leading to full remote code execution with high impact on confidentiality, integrity, and availability. The disclosures highlight continued risk from legacy FTP software that processes untrusted input without proper bounds checking.
Jun 29, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026
Researchers disclosed multiple serious vulnerabilities in **Monsta FTP**, including `CVE-2025-34299` for remote code execution and `CVE-2026-60105`, a high-severity unauthenticated server-side request forgery flaw affecting versions through **2.14.4**. The SSRF issue stems from incomplete IP blocklist validation in the `fetchRemoteFile` feature, allowing attackers to use IPv4-mapped IPv6 addresses such as `::ffff:169.254.169.254` to bypass protections meant to block loopback, private-network, and cloud metadata targets. The SSRF bug lets an unauthenticated attacker obtain a CSRF token, force the server to make HTTP or HTTPS GET requests, and exfiltrate responses to an attacker-controlled FTP server, potentially exposing cloud instance metadata, internal services, and loopback-only resources. VulnCheck said **Monsta FTP 2.14.5** silently fixed the SSRF issue without a security advisory, while separate reporting highlighted the remote code execution risk, leaving organizations using Monsta FTP facing both internal network exposure and possible full server compromise.
Jul 14, 2026