Re: [OE-core] [PATCH 1/5] wget: fix CVE-2026-58469

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Jul 22, 2026 at 10:16 AM CEST, Amaury Couderc via lists.openembedded.org wrote:
> From: Amaury Couderc <amaury.couderc@est.tech>
>
> Backport patch to fix CVE-2026-58469.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-58469
>   https://www.cve.org/CVERecord?id=CVE-2026-58469
>   https://security-tracker.debian.org/tracker/CVE-2026-58469
>   https://ubuntu.com/security/CVE-2026-58469
>   https://osv.dev/list?q=CVE-2026-58469
>
> Upstream fix:
>   https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd]
>
> Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
> ---
>  .../wget/wget/CVE-2026-58469.patch            | 52 +++++++++++++++++++
>  meta/recipes-extended/wget/wget_1.25.0.bb     |  1 +
>  2 files changed, 53 insertions(+)
>  create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch

Hello,

Hetvi Thakar wrote[0] about a related series to wrynose:
> I reviewed the earlier series.
> It looks like the follow-up upstream regression fixes for
> CVE-2026-58469 and CVE-2026-58472 were not included in the backport.
> These follow-up commits are required to complete the backport, and I
> have included them in my series .

Hetvi, do you confirm this is missing here as well?

In the meantime, I think we should hold this series since we suspect it's
missing regression patches.

[0]: https://lore.kernel.org/all/PH7PR11MB8598AB8F89B7886FD3EC9148ADC02@PH7PR11MB8598.namprd11.prod.outlook.com/

Regards,
-- 
Yoann Congal
Smile ECS