GNU Wget vulnerable to URL mishandling

CVE-2024-38428

Summary

A vulnerability exists in GNU Wget versions up to 1.24.5 that affects how semicolons are handled in the userinfo subcomponent of a URI. This mishandling can lead to an insecure scenario where data that should be classified within the userinfo subcomponent is incorrectly interpreted as part of the host subcomponent. This unintended behavior can pose security risks, including exposure of sensitive information or improper URI parsing, necessitating urgent attention for users relying on this tool for secure data transfers.

References