Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-088
Advisory Release Date: 2026-09-28 09:00 Pacific
Advisory Updated Date: 2026-09-28 09:00 Pacific
Severity:
Medium
Issue Overview:
GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase. (CVE-2026-58472)
Affected Packages:
wget1
Issue Correction:
Run yum update wget1 to update your system.
New Packages:
aarch64:
wget1-debuginfo-1.25.0-5.amzn2027.aarch64
wget1-wget-1.25.0-5.amzn2027.aarch64
wget1-1.25.0-5.amzn2027.aarch64
wget1-debugsource-1.25.0-5.amzn2027.aarch64
src:
wget1-1.25.0-5.amzn2027.src
x86_64:
wget1-debuginfo-1.25.0-5.amzn2027.x86_64
wget1-1.25.0-5.amzn2027.x86_64
wget1-wget-1.25.0-5.amzn2027.x86_64
wget1-debugsource-1.25.0-5.amzn2027.x86_64