CRITICAL 9.1 Microsoft

CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Microsoft Security Update 2024-Jun: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Affected Products

cbl2 wget 1.21.2-3 on CBL Mariner 2.0
cbl2 wget 1.21.2-4 on CBL Mariner 2.0

References

Published: 2024-06-11 · Source: Microsoft · Feed updated: 2026-11-02

This critical severity vulnerability with a CVSS score of 9.1 was published on 2024-06-11 via Microsoft. Affected: cbl2 wget 1.21.2-3 on CBL Mariner 2.0, cbl2 wget 1.21.2-4 on CBL Mariner 2.0.

Risk Timeline

CVE Disclosed2024-06-11 · 873 days ago

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38428

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2024-38428

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2025-68615	Net-SNMP snmptrapd crash	CRITICAL	9.8
CVE-2025-32434 PoC	PyTorch: `torch.load` with `weights_only=True` leads to remote code execution	CRITICAL	9.8
CVE-2025-29087	In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can	CRITICAL	9.8
CVE-2025-3277	An integer overflow can be triggered in SQLite’s `concat_ws()` function. The res	CRITICAL	9.8
CVE-2024-24790	Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip	CRITICAL	9.8
CVE-2024-39331	In Emacs before 29.4 org-link-expand-abbrev in lisp/ol.el expands a %(...) link	CRITICAL	9.8

vulnfeed aggregates 17991 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.