GNU Wget 2.3 Released With Security Hardening
The latest utility update addresses memory vulnerabilities and restricts XML parsing depth to prevent overflow exploits.
Updated on Sept. 21, 2026 in Cybersecurity
Live Poll
Do you trust that installing the latest software updates keeps your devices more secure?
Developers have released GNU Wget 2.3, a new version of the command-line utility that introduces critical security patches and improved HTML tag support. The release explicitly targets memory safety by fixing integer and stack overflows.
Why it matters
The update improves the security posture of automated file retrieval workflows by hardening input parsing and cookie handling. These changes mitigate long-standing risks associated with recursive file parsing and path traversal vulnerabilities.
GNU Wget 2.3 imposes a hard cap of 1024 levels for XML parsing recursion and requires GnuTLS version 3.6.5 or newer. The release also mandates that secure cookies must originate from HTTPS sources, a change from prior versions that accepted insecure cookie headers.
The players
GNU Wget
A widely used command-line utility for retrieving content from web servers, supporting HTTP, HTTPS, and FTP protocols.
GnuTLS
A software library that provides support for Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
The details
The update introduces path traversal prevention by sanitizing filenames and reducing them to their base component, preventing attackers from accessing unintended directories. It also patches memory leaks and addresses stack overflows that occurred during the recursive parsing of local files. Furthermore, the release adds support for modern HTML tags such as iframe srcdoc, data-src, and data-srcset to improve compatibility.
Timeline
September 21, 2026: GNU Wget 2.3 was officially released.
The Tech Race
This release advances the utility's security architecture to compete with modern, memory-safe data retrieval tools. It marks a significant departure from the long-standing conventions of the GNU Wget 1.x series by codifying strict input sanitization and HTTPS-only cookie requirements.
Users can immediately improve their local file retrieval security by updating to version 2.3. Organizations should wait for the update to land in their distribution's stable repositories before deploying it to production environments.
The takeaway
The move to sanitizing filenames and capping XML recursion significantly hardens Wget against common parsing exploits. Users should track their specific Linux distribution's repository for the 2.3 package arrival to ensure these patches are applied to their local systems.
Further reading
For more context on how automated tools handle security threats, browse the latest updates in Cybersecurity.
Source note: This article includes information reported by 9to5Linux.
Live Poll
Do you trust that installing the latest software updates keeps your devices more secure?
