Backport fix for CVE-2026-58469 to wget-1.19.5. The patch
addresses a buffer underflow in clean_metalink_string() in
src/metalink.c by replacing manual whitespace checks with
isspace(), adding a bounds guard, fixing an inverted
trailing-space condition, and including the required ctype.h
header. Three upstream commits (37a40fcb, 7b1cdecc, 82d945ff)
are combined into a single patch.
CVE: CVE-2026-58469
Upstream patches:
- 37a40fcb45.patch
- 7b1cdecc49.patch
- 82d945ff5d.patch
Resolves: RHEL-212496
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58471, a buffer overflow in
convert_fname() in src/url.c. The patch (from upstream commit
c2640fe5171c59f87c58dc9fcb195b2d18b010ee) fixes incorrect buffer
size tracking during iconv filename conversion by removing the
flawed `done` variable and replacing the E2BIG reallocation logic
with a correct implementation that properly tracks used bytes,
ensures buffer growth, and updates all size/pointer variables
after reallocation.
CVE: CVE-2026-58471
Upstream patches:
- c2640fe517.patch
Resolves: RHEL-194519
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58472 which addresses an integer
and buffer overflow vulnerability in the html_quote_string() function
in src/convert.c. The patch is based on upstream commits dd692d9 and
f76978a, adapted to use INT_ADD_WRAPV instead of INT_ADD_OK since
the gnulib version bundled with wget 1.19.5 does not provide the
latter. The fix adds overflow-safe integer arithmetic to the string
size calculation and aborts on overflow. Unit tests for
construct_relative, match_except_index, find_fragment, and
html_quote_string are included.
CVE: CVE-2026-58472
Upstream patches:
- dd692d9cea.patch
- f76978a51b.patch
Resolves: RHEL-210627
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
