[rpms/wget1] rawhide: Fix for CVE-2026-16599

[Michal Ruprich <mruprich@redhat.com>]

A new commit has been pushed.

Repo   : rpms/wget1
Branch : rawhide
Commit : 7e171a9a15490dfbf320257290e6e5d9f6677f39
Author : Michal Ruprich <mruprich@redhat.com>
Date   : 2026-09-14T13:13:34+02:00
Stats  : +68/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/wget1/c/7e171a9a15490dfbf320257290e6e5d9f6677f39?branch=rawhide

Log:
Fix for CVE-2026-16599

---
diff --git a/wget-1.25-fix-cve-2026-16599.patch b/wget-1.25-fix-cve-2026-16599.patch
new file mode 100644
index 0000000..14acbb0
--- /dev/null
+++ b/wget-1.25-fix-cve-2026-16599.patch
@@ -0,0 +1,62 @@
+From e9697d98e7249b0f68a6be040a4f3dcc5bc101fa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Sat, 20 Jun 2026 14:39:54 +0200
+Subject: [PATCH] Fix server-controlled unbounded MD5 loop in FTP OPIE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* src/ftp-basic.c (ftp_login): Limit the skey sequence to 9999.
+
+Report:
+wget accepts an unbounded server-controlled integer as the iteration
+count for its OPIE/S-KEY MD5 key-derivation loop. No upper bound is
+enforced on the sequence number supplied by the server in the FTP
+challenge line. The value is passed directly to skey_response() as a
+loop counter, causing wget to perform up to ~2.1 billion full MD5
+computations before responding to the authentication challenge.
+
+Reported-by: Michał Majchrowicz and Marcin Wyczechowski
+---
+ src/ftp-basic.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/src/ftp-basic.c b/src/ftp-basic.c
+index 0f4bb821..af38a69a 100644
+--- a/src/ftp-basic.c
++++ b/src/ftp-basic.c
+@@ -204,12 +204,11 @@ ftp_login (int csock, const char *acc, const char *pass)
+       "331 s/key ",
+       "331 opiekey "
+     };
+-    size_t i;
+     const char *seed = NULL;
+ 
+-    for (i = 0; i < countof (skey_head); i++)
++    for (size_t i = 0; i < countof (skey_head); i++)
+       {
+-        int l = strlen (skey_head[i]);
++        size_t l = strlen (skey_head[i]);
+         if (0 == c_strncasecmp (skey_head[i], respline, l))
+           {
+             seed = respline + l;
+@@ -222,7 +221,15 @@ ftp_login (int csock, const char *acc, const char *pass)
+ 
+         /* Extract the sequence from SEED.  */
+         for (; c_isdigit (*seed); seed++)
+-          skey_sequence = 10 * skey_sequence + *seed - '0';
++          {
++            skey_sequence = 10 * skey_sequence + *seed - '0';
++            if (skey_sequence > 9999)
++              {
++                xfree (respline);
++                return FTPLOGREFUSED;
++              }
++          }
++
+         if (*seed == ' ')
+           ++seed;
+         else
+-- 
+GitLab
+

diff --git a/wget1.spec b/wget1.spec
index 10cc4a7..f0f92d4 100644
--- a/wget1.spec
+++ b/wget1.spec
@@ -1,7 +1,7 @@
 Summary: A utility for retrieving files using the HTTP or FTP protocols
 Name: wget1
 Version: 1.25.0
-Release: 5%{?dist}
+Release: 6%{?dist}
 # Generally wget is distributed under GPLv3 or later but there are files in lib/ directory
 # which are under LGPLv2.1 or later and are actually built into the resulting rpm.
 # This version of wget is built with gnutls so I believe that the 'with openssl'
@@ -16,6 +16,8 @@ Patch3: wget-1.25-fix-cve-2026-58470.patch
 Patch4: wget-1.25-fix-cve-2026-58471.patch
 Patch5: wget-1.25-fix-cve-2026-58472.patch
 Patch6: wget-1.24.5-no-nettle.patch
+# https://gitlab.com/gnuwget/wget/-/commit/e9697d98
+Patch7: wget-1.25-fix-cve-2026-16599.patch
 
 Provides: bundled(gnulib) 
 # needed for test suite
@@ -117,6 +119,9 @@ echo ".so man1/%{name}.1" > %{buildroot}%{_mandir}/man1/wget.1
 %config(noreplace) %{_sysconfdir}/wgetrc
 
 %changelog
+* Mon Sep 14 2026 Michal Ruprich <mruprich@redhat.com> - 1.25.0-6
+- Fix for CVE-2026-16599
+
 * Tue Aug 18 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.25.0-5
 - Use gnutls for NTLM crypto