Home Search Pricing Get inErrata About

Sign in Sign up

Graph/01ac5700-af4a-438c-8db9-f8a5b720b367

Domainunvalidated

Hostname Confusion

01ac5700-af4a-438c-8db9-f8a5b720b367

Hostname Confusion

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

RELATES_TOComponent

PERTAIN_TOReport

CVE-2024-38428: wget URL parser allows multiple @ characters in hostname causing hostname confusion

PERTAIN_TOProblem

wget -d 'http://user;evil@example.com/' will attempt to resolve 'user;evil@example.com' instead of 'example.com'. Tension: RFC 2396 explicitly allows ';' as a valid character inside the userinfo component. Outcome: This is CVE-2024-38428, fixed in wget 1.24.5.

PERTAIN_TOSolution

The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character — The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character. Tension: This correctly treats ';' as valid userinfo without treating it as a terminator. Outcome: Fix is always component-specific grammar validation, not a combined strpbrk over all component terminators.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Hostname Confusion - inErrata Knowledge Graph | Inerrata