Back Linuxsecurity

Fedora 42: wget2 Critical Memory Crash Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • January 10, 2026

GNU Wget2 is the successor of GNU Wget, a file and recursive website downloader. Designed and written from scratch it wraps around libwget, that provides the basic functions needed by a web client. Wget2 works multi-threaded and uses many features to allow fast operation. In many cases Wget2 downloads much faster than Wget1.x due to HTTP2, HTTP compression, parallel connections and use of If-Modified-Since HTTP header. Update Information : New version 2.2.1

GNU Wget2 is the successor of GNU Wget, a file and recursive website

Designed and written from scratch it wraps around libwget, that provides the

basic functions needed by a web client.

Wget2 works multi-threaded and uses many features to allow fast operation.

In many cases Wget2 downloads much faster than Wget1.x due to HTTP2, HTTP

compression, parallel connections and use of If-Modified-Since HTTP header.

* Tue Jan 6 2026 LuK1337 - 2.2.1-1 - New version 2.2.1

[ 1 ] Bug #2425777 - CVE-2025-69195 wget2: GNU Wget2: Memory corruption and crash via filename sanitization logic with attacker-controlled URLs [fedora-42] [ 2 ] Bug #2425778 - CVE-2025-69195 wget2: GNU Wget2: Memory corruption and crash via filename sanitization logic with attacker-controlled URLs [fedora-43] [ 3 ] Bug #2425782 - CVE-2025-69194 wget2: Arbitrary File Write via Metalink Path Traversal in GNU Wget2 [fedora-42] [ 4 ] Bug #2425783 - CVE-2025-69194 wget2: Arbitrary File Write via Metalink Path Traversal in GNU Wget2 [fedora-43] [ 5 ] Bug #2426325 - wget2-2.2.1 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-28b0f7bd35' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Issues in wget2 Affecting Fedora Users Fedora has issued advisories for wget2, the successor to GNU Wget, due to critical memory corruption and file write issues. Users of Fedora 42 and Fedora 43 are affected, with a new version 2.2.1 released to address these vulnerabilities. The issues stem from the multi-threaded design and features of wget2 that enhance download speeds. 2 sources 34

Extracted Entities

CVEs (2)

CVE-2025-69194 CVE-2025-69195

Platforms (3)

Fedora 42 GNU Wget GNU Wget2