{"id":"CVE-2024-38428","aliases":["ALSA-2024:5299","ALSA-2024:6192","AZL-42691","CLSA-2024-1723223824","CLSA-2024-1723223949","CLSA-2024-1723794812","CLSA-2024-1723795173","CLSA-2024-1723796201","CLSA-2024-1723826300","CLSA-2024-1725898066","CLSA-2024-1733428726","CLSA-2025-1747851041","CLSA-2025-1756409198","CLSA-2025-1756409922","CLSA-2025-1762783856","DEBIAN-CVE-2024-38428","DLA-4133-1","EUVD-2024-37320","GHSA-2j66-vp53-phjj","JLSEC-2026-120","MGASA-2024-0240","OESA-2024-1756","RHSA-2024:4998","RHSA-2024:5299","RHSA-2024:6192","RHSA-2024:6208","RHSA-2024:6438","RLSA-2024:5299","RLSA-2024:6192","ROOT-OS-DEBIAN-12-CVE-2024-38428","SUSE-SU-2024:2154-1","SUSE-SU-2024:2174-1","SUSE-SU-2024:2174-2","SUSE-SU-2024:2201-1","SUSE-SU-2025:20010-1","UBUNTU-CVE-2024-38428","USN-6852-1","USN-6852-2","USN-8543-1","openSUSE-SU-2024:14056-1"],"status":"published","title":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and...","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00672,"percentile":0.5234,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2024-06-16T00:00:00Z","modified":"2026-11-02T12:02:42Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"wget","fixed_in":["1.19.5-12.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"wget","fixed_in":["1.21.1-8.el9_4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"wget","fixed_in":["1.21.2-3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"wget","fixed_in":["1.17.1-1ubuntu1.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"wget","fixed_in":["1.19.4-1ubuntu2.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"wget","fixed_in":["1.19.5-11.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"wget","fixed_in":["1.19.5-11.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"wget","fixed_in":["1.14-18.el7_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"wget","fixed_in":["1.19.5-11.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"wget","fixed_in":["1.21.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"wget","fixed_in":["1.14-18.el7_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"wget","fixed_in":["1.14-18.el7_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"wget","fixed_in":["1.12-10.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"wget","fixed_in":["1.12-10.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"wget","fixed_in":["1.20.1-1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.21.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.24.5-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.24.5-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"wget","fixed_in":["1.21-1+deb11u2"],"sources":["osv"]},{"ecosystem":"Julia","package":"wget_jll","fixed_in":["1.25.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"wget","fixed_in":["1.21.4-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","fixed_in":["1.20.3-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"wget","fixed_in":["1.21.2-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"wget","fixed_in":["1.21.2-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"wget","fixed_in":["1.21.4-2.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget-debuginfo","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget-debugsource","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget-debuginfo","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget-debugsource","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget-debuginfo","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget-debugsource","fixed_in":["0:1.19.5-10.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget","fixed_in":["0:1.19.5-12.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget-debuginfo","fixed_in":["0:1.19.5-12.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget-debugsource","fixed_in":["0:1.19.5-12.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget","fixed_in":["0:1.21.1-8.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget-debuginfo","fixed_in":["0:1.21.1-8.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget-debugsource","fixed_in":["0:1.21.1-8.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget","fixed_in":["0:1.19.5-11.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget-debuginfo","fixed_in":["0:1.19.5-11.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget-debugsource","fixed_in":["0:1.19.5-11.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget","fixed_in":["0:1.21.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget-debuginfo","fixed_in":["0:1.21.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget-debugsource","fixed_in":["0:1.21.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"wget","fixed_in":["0:1.19.5-12.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"wget","fixed_in":["0:1.21.1-8.el9_4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"wget","fixed_in":["1.21.3-1+deb12u1.root.io.1","1.21.3-1+deb12u1.aikido.5","1.21.3-1+deb12u1.root.io.2","1.21.3-1+deb12u1.root.io.3","1.21.3-1+deb12u1.root.io.4","1.21.3-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-wget","fixed_in":["1.21.3-1+deb12u1.root.io.1","1.21.3-1+deb12u1.aikido.5","1.21.3-1+deb12u1.root.io.2","1.21.3-1+deb12u1.root.io.3","1.21.3-1+deb12u1.root.io.4","1.21.3-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wget","fixed_in":["1.14-21.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wget","fixed_in":["1.14-21.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","fixed_in":["1.20.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"wget","fixed_in":["1.20.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"wget","fixed_in":["1.20.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"wget","fixed_in":["1.20.3-150600.19.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"wget","fixed_in":["1.20.3-150600.19.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"wget","fixed_in":["1.24.5-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wget","fixed_in":["1.15-1ubuntu1.14.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","fixed_in":["1.17.1-1ubuntu1.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","fixed_in":["1.19.4-1ubuntu2.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"wget","fixed_in":["1.20.3-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"wget","fixed_in":["1.21.2-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"wget","fixed_in":["1.21.4-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wget","fixed_in":["1.24.5-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-12.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-11.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-11.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-18.el7_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-11.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-18.el7_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-18.el7_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-10.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-10.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1+deb12u1"}]}],"versions":["1.21.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1+deb11u2"}]}],"versions":["1.21-1","1.21-1+deb11u1"]},{"source":"osv","ecosystem":"Julia","package":"wget_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-2.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-10.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-12.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-12.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-12.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-8.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-8.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-8.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-11.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-11.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-11.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"wget-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-12.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.1-8.el9_4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1+deb12u1.root.io.1"},{"fixed":"1.21.3-1+deb12u1.aikido.5"},{"fixed":"1.21.3-1+deb12u1.root.io.2"},{"fixed":"1.21.3-1+deb12u1.root.io.3"},{"fixed":"1.21.3-1+deb12u1.root.io.4"},{"fixed":"1.21.3-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1+deb12u1.root.io.1"},{"fixed":"1.21.3-1+deb12u1.aikido.5"},{"fixed":"1.21.3-1+deb12u1.root.io.2"},{"fixed":"1.21.3-1+deb12u1.root.io.3"},{"fixed":"1.21.3-1+deb12u1.root.io.4"},{"fixed":"1.21.3-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150600.19.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150600.19.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.5+esm2"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3","1.15-1ubuntu1.14.04.4","1.15-1ubuntu1.14.04.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.5+esm1"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4","1.17.1-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2+esm1"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1","1.19.4-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu2.1"}]}],"versions":["1.20.3-1ubuntu1","1.20.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-2ubuntu1.1"}]}],"versions":["1.21-1ubuntu3","1.21-1ubuntu4","1.21-1ubuntu5","1.21.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1ubuntu4.1"}]}],"versions":["1.21.3-1ubuntu1","1.21.4-1ubuntu1","1.21.4-1ubuntu2","1.21.4-1ubuntu3","1.21.4-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu2.1"}]}],"versions":["1.20.3-1ubuntu1","1.20.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-2ubuntu1.1"}]}],"versions":["1.21-1ubuntu3","1.21-1ubuntu4","1.21-1ubuntu5","1.21.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1ubuntu4.1"}]}],"versions":["1.21.3-1ubuntu1","1.21.4-1ubuntu1","1.21.4-1ubuntu2","1.21.4-1ubuntu3","1.21.4-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.5+esm1"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4","1.17.1-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2+esm1"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1","1.19.4-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.5+esm2"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3","1.15-1ubuntu1.14.04.4","1.15-1ubuntu1.14.04.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.5+esm3"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3","1.17.1-1ubuntu1.4","1.17.1-1ubuntu1.5","1.17.1-1ubuntu1.5+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2+esm3"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2","1.19.4-1ubuntu2.1","1.19.4-1ubuntu2.2","1.19.4-1ubuntu2.2+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu2.1+esm2"}]}],"versions":["1.20.3-1ubuntu1","1.20.3-1ubuntu2","1.20.3-1ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-2ubuntu1.3"}]}],"versions":["1.21-1ubuntu3","1.21-1ubuntu4","1.21-1ubuntu5","1.21.2-2ubuntu1","1.21.2-2ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1ubuntu4.3"}]}],"versions":["1.21.3-1ubuntu1","1.21.4-1ubuntu1","1.21.4-1ubuntu2","1.21.4-1ubuntu3","1.21.4-1ubuntu4","1.21.4-1ubuntu4.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-2ubuntu4.2"}]}],"versions":["1.25.0-2ubuntu3","1.25.0-2ubuntu4"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.5-2.1"}]}]}],"products":[{"vendor":"gnu","product":"wget"}],"references":[{"url":"https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html","tags":["x_transferred","Mailing List","Patch","web","article","report"]},{"url":"https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace","tags":["x_transferred","Mailing List","Patch","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241115-0005/","tags":["advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38428","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241115-0005"},{"url":"https://github.com/advisories/GHSA-2j66-vp53-phjj"},{"url":"https://access.redhat.com/errata/RHSA-2024:5299","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38428","tags":["report"]},{"url":"https://bugzilla.redhat.com/2292836","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5299.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6192","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-6192.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1723223824.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1723223949.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1723794812.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1723795173.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1723796201.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1723826300.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1725898066.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/oraclelinux7-els/CLSA-2024-1733428726.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/rhel7-els/CLSA-2025-1747851041.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2025-1756409198.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1756409922.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762783856.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38428.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38428","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33327","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-June/035703.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1756","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4998","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292836","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4998.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38428","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5299.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6192.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6208","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6208.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6438","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6438.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5299","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6192","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242154-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226419","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38428","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242174-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242174-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242201-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520010-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-38428","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6852-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6852-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8543-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-58469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58472","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-38428","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T00:00:00Z","modified":"2025-04-21T10:03:18.212Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-37320","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T00:00:00Z","modified":"2025-04-21T10:03:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:52:19.235376Z"}],"ghsa":[{"id":"GHSA-2j66-vp53-phjj","title":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and...","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T03:30:34Z","modified":"2025-04-21T12:30:24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:01:58.520974Z"}],"nvd":[{"id":"CVE-2024-38428","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T03:15:08.43Z","modified":"2026-06-17T07:40:15.51Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:10:05.620461Z"}],"osv":[{"id":"AZL-42691","title":"CVE-2024-38428 affecting package wget for versions less than 1.21.2-3","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T03:15:08Z","modified":"2026-04-21T04:30:41.819376Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2024-38428","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T00:00:00Z","modified":"2026-11-09T02:45:11.547422288Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-07T03:07:53.435916Z"},{"id":"DEBIAN-CVE-2024-38428","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T03:15:08.43Z","modified":"2026-11-02T12:02:42.057974736Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"JLSEC-2026-120","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2026-04-15T20:29:47.271Z","modified":"2026-07-18T00:01:32.622784357Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2024-1756","title":"wget security update","description":"GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.\r\n\r\nSecurity Fix(es):\r\n\r\nurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.(CVE-2024-38428)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:24.700061128Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:4998","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T20:25:30Z","modified":"2026-07-19T10:05:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5299","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T20:25:38Z","modified":"2026-07-19T10:05:44Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6192","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T20:25:55Z","modified":"2026-07-19T10:06:05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6208","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T20:25:46Z","modified":"2026-07-19T10:06:06Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6438","title":"Red Hat Security Advisory: wget security update","status":"published","published":"2024-09-16T20:26:04Z","modified":"2026-07-19T10:06:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:5299","title":"Moderate: wget security update","description":"The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.\n\nSecurity Fix(es):\n\n* wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:47.582046Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:6192","title":"Moderate: wget security update","description":"The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.\n\nSecurity Fix(es):\n\n* wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:13:09.903227Z","modified":"2025-10-07T17:38:17.591445Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-38428","title":"CVE-2024-38428 in wget - Patched by Root","description":"Root has patched CVE-2024-38428 in the wget package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-07T07:28:44Z","modified":"2026-10-07T08:15:05.584515291Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-38428","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.","status":"published","published":"2024-06-16T03:15:00Z","modified":"2026-07-15T04:14:42.109067076Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"ALSA-2024:5299","title":"Moderate: wget security update","description":"The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.\n\nSecurity Fix(es):\n\n* wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-10-29T11:02:21.523389153Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:6192","title":"Moderate: wget security update","description":"The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.\n\nSecurity Fix(es):\n\n* wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-10-29T11:32:03.424706185Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2024-1723223824","title":"Fix CVE(s): CVE-2024-38428","description":"   * SECURITY UPDATE: Insecure behavior with semicolons in URI userinfo\n     - debian/patches/CVE-2024-38428.patch: Properly re-implement userinfo\n       parsing (rfc2396) to fix outdated RFC implementation\n     - CVE-2024-38428","status":"published","published":"2024-08-09T17:17:07Z","modified":"2026-06-04T10:04:06.233695Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1723223949","title":"Fix CVE(s): CVE-2024-38428","description":"   * SECURITY UPDATE: Insecure behavior with semicolons in URI userinfo\n     - debian/patches/CVE-2024-38428.patch: Properly re-implement userinfo\n       parsing (rfc2396) to fix outdated RFC implementation\n     - CVE-2024-38428","status":"published","published":"2024-08-09T17:19:12Z","modified":"2026-06-04T10:04:13.675898Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1723794812","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)\n- Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing\n- Providing wget -O and -q parameters while running in background generates a\n  wget-log file","status":"published","published":"2024-08-16T07:53:35Z","modified":"2026-06-01T00:32:55.092299068Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1723795173","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)\n- Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing\n- Providing wget -O and -q parameters while running in background generates a\n  wget-log file","status":"published","published":"2024-08-16T07:59:36Z","modified":"2026-06-01T00:33:22.716437619Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1723796201","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)","status":"published","published":"2024-08-16T08:16:44Z","modified":"2026-06-01T00:33:05.130057822Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1723826300","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)\n- Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing\n- Providing wget -O and -q parameters while running in background generates a\n  wget-log file","status":"published","published":"2024-08-16T16:38:23Z","modified":"2026-06-01T00:33:20.490819154Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1725898066","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing","status":"published","published":"2024-09-09T16:07:49Z","modified":"2026-06-01T00:30:04.319653158Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1733428726","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)","status":"published","published":"2024-12-05T19:58:53Z","modified":"2026-06-01T00:33:26.110324659Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1747851041","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)","status":"published","published":"2025-05-21T18:32:14Z","modified":"2026-06-01T00:33:27.417500959Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1756409198","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to\n  prevent insecure behavior","status":"published","published":"2025-08-28T19:26:42Z","modified":"2026-06-01T00:33:25.999978827Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1756409922","title":"wget: Fix of CVE-2024-38428","description":"- CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to\n  prevent insecure behavior","status":"published","published":"2025-08-28T19:38:46Z","modified":"2026-06-01T00:33:16.636866267Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1762783856","title":"Fix CVE(s): CVE-2024-38428","description":"   * SECURITY UPDATE: mishandling of semicolons in userinfo\n     - debian/patches/CVE-2024-38428.patch: properly re-implement userinfo\n       parsing in src/url.c.\n     - CVE-2024-38428","status":"published","published":"2025-11-10T14:11:01Z","modified":"2026-06-04T10:04:12.335829Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-4133-1","title":"wget - security update","status":"published","published":"2025-04-21T00:00:00Z","modified":"2026-03-09T01:19:46.289298Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0240","title":"Updated wget packages fix security vulnerability","description":"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo\nsubcomponent of a URI, and thus there may be insecure behavior in which\ndata that was supposed to be in the userinfo subcomponent is\nmisinterpreted to be part of the host subcomponent. (CVE-2024-38428)\n","status":"published","published":"2024-06-27T17:12:06Z","modified":"2026-04-16T04:44:15.336924565Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14056-1","title":"wget-1.24.5-2.1 on GA media","description":"These are all security issues fixed in the wget-1.24.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-18T00:00:00Z","modified":"2026-02-04T04:00:26.254608Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2154-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)\n","status":"published","published":"2024-06-21T14:15:13Z","modified":"2026-02-04T03:21:29.362741Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2174-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)\n","status":"published","published":"2024-06-24T05:20:50Z","modified":"2026-02-04T03:50:48.603477Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2174-2","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)\n","status":"published","published":"2024-06-24T05:20:58Z","modified":"2026-02-04T02:31:07.653501Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2201-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)\n","status":"published","published":"2024-06-25T11:53:40Z","modified":"2026-02-04T04:04:33.833913Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20010-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)\n\n- Update to GNU wget 1.24.5:\n  * Fix how subdomain matches are checked for HSTS.\n  * Wget will now also parse the srcset attribute in \u003csource\u003e HTML tags\n  * Support reading fetchmail style \"user\" and \"passwd\" fields from netrc\n  * In some cases, prevent the confusing \"Cannot write to... (success)\" error messages\n  * Support extremely fast download speeds (TB/s)\n  * Ensure that CSS URLs are corectly quoted\n  * libproxy support is now upstream- drop wget-libproxy.patch\n","status":"published","published":"2025-02-03T08:47:27Z","modified":"2026-03-23T04:50:02.091634Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6852-1","title":"wget vulnerability","description":"It was discovered that Wget incorrectly handled semicolons in the userinfo\nsubcomponent of a URI. A remote attacker could possibly trick a user into\nconnecting to a different host than expected.\n","status":"published","published":"2024-06-26T12:20:33Z","modified":"2026-04-27T17:17:17.5365Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6852-2","title":"wget vulnerability","description":"USN-6852-1 fixed a vulnerability in Wget. This update provides\nthe corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Wget incorrectly handled semicolons in the userinfo\n subcomponent of a URI. A remote attacker could possibly trick a user into\n connecting to a different host than expected.\n","status":"published","published":"2024-06-27T10:42:13Z","modified":"2026-06-25T13:32:28.677802295Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-8543-1","title":"wget vulnerabilities","description":"It was discovered that Wget mishandled semicolons in the userinfo\nsubcomponent of a URL. A remote attacker could possibly use this issue\nto trick a user into connecting to a different host than intended. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2024-38428)\n\nIt was discovered that Wget incorrectly handled Metalink documents\ncontaining a whitespace-only URL. A remote attacker could possibly use\nthis issue to cause a denial of service. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu\n26.04 LTS. (CVE-2026-58469)\n\nIt was discovered that Wget incorrectly handled Content-Range header\nvalues, leading to an integer overflow. A remote attacker could\npossibly use this issue to cause download desynchronization.\n(CVE-2026-58470)\n\nIt was discovered that Wget incorrectly handled character set\nconversion of server-supplied filenames. A remote attacker could possibly\nuse this issue to cause a denial of service or possibly execute arbitrary\ncode. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58471)\n\nIt was discovered that Wget incorrectly handled HTML attributes\nrequiring entity encoding. A remote attacker could possibly use this issue\nto cause a denial of service or possibly execute arbitrary code.\n(CVE-2026-58472)","status":"published","published":"2026-07-14T19:06:42Z","modified":"2026-07-15T04:14:42.030352513Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}