CVE-2026-1858
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU).
Published Apr 29, 2026 · updated Jun 17, 2026 · gnu wget2
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 29, 2026 · NIST NVD
Detected
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Jun 17, 2026 · NIST NVD
Updated
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Affected
- cpe gnu/wget2version unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-1858
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-1858
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
nvd.nist.gov