url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a…
Priority MEDIUM 40CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00672 52nd percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 5 advisories
- RHSA-2024:6438 Released 2024-09-05 · Red Hat rating Moderatewget security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) wget-1.21.1-7.el9_2.1
- RHSA-2024:6192 Released 2024-09-03 · Red Hat rating Moderatewget security update
- Red Hat Enterprise Linux AppStream (v. 9) wget-1.21.1-8.el9_4
- RHSA-2024:6208 Released 2024-09-03 · Red Hat rating Moderatewget security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) wget-1.19.5-11.el8_8.1
Show 2 more Red Hat advisories
- RHSA-2024:5299 Released 2024-08-13 · Red Hat rating Moderatewget security update
- Red Hat Enterprise Linux AppStream (v. 8) wget-1.19.5-12.el8_10
- RHSA-2024:4998 Released 2024-08-06 · Red Hat rating Moderatewget security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) wget-1.19.5-10.el8_6.2
- Red Hat Enterprise Linux AppStream E4S (v.8.6) wget-1.19.5-10.el8_6.2
- Red Hat Enterprise Linux AppStream TUS (v.8.6) wget-1.19.5-10.el8_6.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:5299 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:6192 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4998 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4998 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:6208 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:6438 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4998 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38428
- 2026-10-03 Alias added: GHSA-2j66-vp53-phjj
References
More GNU Wget vulnerabilities
- TI-2017-09727 GNU Wget: stack overflow in HTTP protocol handling CVSS 3.0HIGH 8.8
- TI-2016-04293 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… CVSS 3.1HIGH 8.8
- TI-2014-04014 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… CVSS 2.0HIGH 9.3
- TI-2017-09728 GNU Wget: heap overflow in HTTP protocol handling CVSS 3.0HIGH 8.8
- TI-2019-04244 Out-of-bounds write in GNU Wget CVSS 3.0CRITICAL 9.8
- TI-2016-06103 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to… CVSS 3.0HIGH 8.1
Sources
- CVE-2024-38428 · CVE Program
- CVE-2024-38428 · NVD
- FIRST EPSS
- GHSA-2j66-vp53-phjj · GitHub Advisory Database · CC BY 4.0
- CVE-2024-38428 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences