CVE-2016-7098: gnu wget Race Condition
Vulnerability summary
CVE-2016-7098 is a high (CVSS 8.1) Race Condition vulnerability in gnu wget. EPSS estimates a 7.50% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 26-09-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.50%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.50% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (lists.gnu.org)
Maturity: unknown
GNU Wget < 1.18 - Access List Bypass / Race Condition
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Suse7 products
- wget&distro=SUSE Linux Enterprise Desktop 12 SP1< 1.14-17.1
- wget&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.14-17.1
- wget&distro=SUSE Linux Enterprise Server 12 SP1< 1.14-17.1
- wget&distro=SUSE Linux Enterprise Server 12 SP2< 1.14-17.1
- wget&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 1.14-17.1
Debian1 product
- wget< 1.18-4 | < 1.16-1+deb8u7
Gnu1 product
- wget≤ 1.17
Ubuntu1 product
- wget< 1.15-1ubuntu1.14.04.3 | < 1.17.1-1ubuntu1.3
4 vendors · 10 products
References
19 links- lists.opensuse.org/opensuse-updates/2016-09/msg00044.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
Show all 19 references
- bugzilla.suse.com/995964REPORT