CVE-2024-38428: URL parser hostname confusion via multiple @ characters in userinfo

The wget URL parser improperly handles userinfo (username:password) components in URLs when they contain multiple '@' characters. The vulnerability allows an attacker to craft URLs that cause hostname confusion, where the parsed hostname differs from the user-visible hostname. This can lead to security bypass or credential leakage.