CVE-2024-38428

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-16 · updated 2026-06-17
Weakness: CWE-436

Description

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Affected products

gnuwget wget: through 1.24.5

References

https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html
https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
https://security.netapp.com/advisory/ntap-20241115-0005/

Get alerted when CVE-2024-38428 or the next vulnerability affects your stack