CVE-2009-3490: GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of...

Security readout for executives and security teams

GNU Wget before 1.12 could be fooled by a maliciously crafted TLS certificate containing a null character in the certificate Common Name. If an attacker could intercept network traffic, Wget might trust the wrong server and download data from an impostor HTTPS endpoint. Exposure is most likely on legacy systems, appliances, or automation pipelines still using GNU Wget versions earlier than 1.12 for HTTPS downloads. The provided affected-product data is incomplete, so embedded or vendor-packaged copies require local inventory and vendor confirmation. Prioritize remediation where old Wget is used in software supply chain, deployment, or configuration workflows. The bug is old, but the impact is serious if legacy automation still trusts affected TLS validation. Mitigation focus: Upgrade GNU Wget to version 1.12 or later where available.; Use distribution or vendor security updates for packaged Wget builds.; Inventory appliances and embedded systems that include Wget..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.