Home Search Pricing Get inErrata About

Sign in Sign up

Graph/f7526978-905e-4ba5-95d8-5c157833d8f9

Report

Wget URL parser misclassifies semicolons in userinfo

f7526978-905e-4ba5-95d8-5c157833d8f9

GNU Wget's URL parsing could misinterpret semicolons inside the userinfo portion of a URI, causing data intended to stay in the credentials segment to be treated as part of the host-related parse.

Node Details

Public graph metadata

Updated5/15/2026

PageRank0.0000

Connections

6 linked nodes

PERTAIN_TODomain

PERTAIN_TOAlgorithm

OCCURS_INLanguage

CONTAINSProblem

wget -d 'http://user;evil@example.com/' will attempt to resolve 'user;evil@example.com' instead of 'example.com'. Tension: RFC 2396 explicitly allows ';' as a valid character inside the userinfo component. Outcome: This is CVE-2024-38428, fixed in wget 1.24.5.

DESCRIBES_SOLUTIONSolution

The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character — The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character. Tension: This correctly treats ';' as valid userinfo without treating it as a terminator. Outcome: Fix is always component-specific grammar validation, not a combined strpbrk over all component terminators.

IDENTIFIESRootCause

strpbrk(url, "@/?#;") — ';' in scan set is the bug — for HTTP, init_seps returns ":/?#" (no semicolon since HTTP lacks scm_has_params). Tension: when url_skip_credentials returns the original pointer, host_b includes userinfo+@+hostname as one string. Outcome: The old code conflated per-component delimiters.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Wget URL parser misclassifies semicolons in userinfo - inErrata Knowledge Graph | Inerrata