GNU wget computes an MD5 key‑derivation loop based on a sequence number supplied in the FTP challenge line. Because the sequence number is used as an iteration count without bounds checking, an attacker can send a value near the maximum integer, causing wget to perform roughly two billion MD5 calculations and suspend for an extended period. This results in a denial of service for any wget process that attempts the authentication, potentially affecting multiple concurrent users if the service is called repeatedly.

The vulnerability exists in the GNU wget project. The affected product is the wget command‑line tool; all versions prior to commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa are vulnerable. Users of wget on any platform that connects to FTP servers using OPIE/S-KEY authentication are at risk.

The CVSS score of 5.1 indicates a moderate severity. EPSS is unavailable, so the exploitation probability is unclear, but the attack does not require special privileges or a network foothold beyond the ability to send a crafted FTP challenge. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploits yet. However, the lack of an upper bound on the iteration count makes the attack trivial once a suitable server is in place.