CVE catalog

CVE-2024-38428

Wget vulnerability

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.67% · Oct 25, 2026

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwgetsid1.25.0-3fixed
Debianwgetforky1.25.0-3fixed
Debianwgettrixie1.25.0-2fixed
Debianwgetbookworm1.21.3-1+deb12u1fixed
Ubuntuwgetnoble1.21.3-1+deb12u1fixed
Ubuntuwgetnoble1.21.4-1ubuntu4.1fixed
Ubuntuwgetnoble1.21.4-1ubuntu4.3fixed
Ubuntuwgetpro1.19.1-3ubuntu1vulnerable
Ubuntuwgetpro1.19.1-3ubuntu1.1vulnerable
Ubuntuwgetpro1.19.2-1ubuntu1vulnerable
Ubuntuwgetpro1.19.3-2ubuntu1vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.1vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.2vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.2+esm1fixed
Ubuntuwget20.041.20.3-1ubuntu1vulnerable
Ubuntuwget20.041.20.3-1ubuntu2vulnerable
Ubuntuwget20.041.20.3-1ubuntu2.1fixed
Ubuntuwget22.041.21-1ubuntu3vulnerable
Ubuntuwget22.041.21-1ubuntu4vulnerable
Ubuntuwget22.041.21-1ubuntu5vulnerable
Ubuntuwget22.041.21.2-2ubuntu1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.1fixed
Ubuntuwget24.041.21.3-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu2vulnerable
Ubuntuwget24.041.21.4-1ubuntu3vulnerable
Ubuntuwget24.041.21.4-1ubuntu4vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.1fixed
Ubuntuwgetpro1.20.3-1ubuntu1vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1vulnerable
Ubuntuwgetpro1.20.3-1ubuntu2.1+esm2fixed
Ubuntuwget22.041.21-1ubuntu3vulnerable
Ubuntuwget22.041.21-1ubuntu4vulnerable
Ubuntuwget22.041.21-1ubuntu5vulnerable
Ubuntuwget22.041.21.2-2ubuntu1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.3fixed
Ubuntuwget24.041.21.3-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu2vulnerable
Ubuntuwget24.041.21.4-1ubuntu3vulnerable
Ubuntuwget24.041.21.4-1ubuntu4vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.1vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.3fixed
Ubuntuwget26.041.25.0-2ubuntu3vulnerable
Ubuntuwget26.041.25.0-2ubuntu4vulnerable
Ubuntuwget26.041.25.0-2ubuntu4.2fixed
Ubuntuwgetpro1.19.1-3ubuntu1vulnerable
Ubuntuwgetpro1.19.1-3ubuntu1.1vulnerable
Ubuntuwgetpro1.19.2-1ubuntu1vulnerable
Ubuntuwgetpro1.19.3-2ubuntu1vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.1vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.2vulnerable
Ubuntuwgetpro1.19.4-1ubuntu2.2+esm1fixed
Ubuntuwget20.041.20.3-1ubuntu1vulnerable
Ubuntuwget20.041.20.3-1ubuntu2vulnerable
Ubuntuwget20.041.20.3-1ubuntu2.1fixed
Ubuntuwget22.041.21-1ubuntu3vulnerable
Ubuntuwget22.041.21-1ubuntu4vulnerable
Ubuntuwget22.041.21-1ubuntu5vulnerable
Ubuntuwget22.041.21.2-2ubuntu1vulnerable
Ubuntuwget22.041.21.2-2ubuntu1.1fixed
Ubuntuwget24.041.21.3-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu1vulnerable
Ubuntuwget24.041.21.4-1ubuntu2vulnerable
Ubuntuwget24.041.21.4-1ubuntu3vulnerable
Ubuntuwget24.041.21.4-1ubuntu4vulnerable
Ubuntuwget24.041.21.4-1ubuntu4.1fixed
Susewgetlinux micro 6.01.24.5-1.1fixed
Susewgetlinux enterprise module for basesystem 15 sp61.20.3-150600.19.3.1fixed
Opensusewgetleap 15.61.20.3-150600.19.3.1fixed
Opensusewgettumbleweed1.24.5-2.1fixed
Susewgetlinux enterprise micro 5.51.20.3-150000.3.20.1fixed
Susewgetlinux enterprise module for basesystem 15 sp51.20.3-150000.3.20.1fixed
Opensusewgetleap 15.51.20.3-150000.3.20.1fixed
Susewgetlinux enterprise server 12 sp51.14-21.19.1fixed
Susewgetlinux enterprise server for sap applications 12 sp51.14-21.19.1fixed
Susewgetlinux enterprise micro 5.51.20.3-150000.3.20.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwgetsourcesid1.24.5-2not yet assignedNot reported[1073523]
Debianwgetsourceforky1.24.5-2not yet assignedNot reported[1073523]
Debianwgetsourcetrixie1.24.5-2not yet assignedNot reported[1073523]
Debianwgetsourcebookworm1.21.3-1+deb12u1not yet assignedNot reported[1073523]
Ubuntuwgetdebnoble1.21.3-1+deb12u1Not reportedNot reportedNot reported
Ubuntuwgetdebnoble1.21.4-1ubuntu4.1Not reportedNot reportedNot reported
Ubuntuwgetdebnoble1.21.4-1ubuntu4.3Not reportedNot reportedNot reported
Ubuntuwgetdebpro1.19.4-1ubuntu2.2+esm1Not reportedUBUNTU-CVE-2024-38428Not reported
Ubuntuwgetdeb20.041.20.3-1ubuntu2.1Not reportedUBUNTU-CVE-2024-38428Not reported
Ubuntuwgetdeb22.041.21.2-2ubuntu1.1Not reportedUBUNTU-CVE-2024-38428Not reported
Ubuntuwgetdeb24.041.21.4-1ubuntu4.1Not reportedUBUNTU-CVE-2024-38428Not reported
Ubuntuwgetdebpro1.20.3-1ubuntu2.1+esm2Not reportedUSN-8543-1Not reported
Ubuntuwgetdeb22.041.21.2-2ubuntu1.3Not reportedUSN-8543-1Not reported
Ubuntuwgetdeb24.041.21.4-1ubuntu4.3Not reportedUSN-8543-1Not reported
Ubuntuwgetdeb26.041.25.0-2ubuntu4.2Not reportedUSN-8543-1Not reported
Ubuntuwgetdebpro1.19.4-1ubuntu2.2+esm1Not reportedUSN-6852-2Not reported
Ubuntuwgetdeb20.041.20.3-1ubuntu2.1Not reportedUSN-6852-1Not reported
Ubuntuwgetdeb22.041.21.2-2ubuntu1.1Not reportedUSN-6852-1Not reported
Ubuntuwgetdeb24.041.21.4-1ubuntu4.1Not reportedUSN-6852-1Not reported
Susewgetrpmlinux micro 6.01.24.5-1.1Not reportedSUSE-SU-2025:20010-1Not reported
Susewgetrpmlinux enterprise module for basesystem 15 sp61.20.3-150600.19.3.1Not reportedSUSE-SU-2024:2201-1Not reported
Opensusewgetrpmleap 15.61.20.3-150600.19.3.1Not reportedSUSE-SU-2024:2201-1Not reported
Opensusewgetrpmtumbleweed1.24.5-2.1Not reportedOPENSUSE-SU-2024:14056-1Not reported
Susewgetrpmlinux enterprise micro 5.51.20.3-150000.3.20.1Not reportedSUSE-SU-2024:2174-1Not reported
Susewgetrpmlinux enterprise module for basesystem 15 sp51.20.3-150000.3.20.1Not reportedSUSE-SU-2024:2174-1Not reported
Opensusewgetrpmleap 15.51.20.3-150000.3.20.1Not reportedSUSE-SU-2024:2174-1Not reported
Susewgetrpmlinux enterprise server 12 sp51.14-21.19.1Not reportedSUSE-SU-2024:2154-1Not reported
Susewgetrpmlinux enterprise server for sap applications 12 sp51.14-21.19.1Not reportedSUSE-SU-2024:2154-1Not reported
Susewgetrpmlinux enterprise micro 5.51.20.3-150000.3.20.1Not reportedSUSE-SU-2024:2174-2Not reported

[Debian bug #1073523]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [wget-lang]Unknown

    Source package: [wget]

    Details (1)

    • 1.25.0-7.1 · noarch · tumbleweed

      Unknown · Fixed: 1.24.5-2.1

      Version impact unknown

      usn · wget · opensuse · tumbleweed

  • [wget]Fixed

    Source package: [wget]

    Details (1)

    • 1.25.0-7.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.24.5-2.1

      usn · wget · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [wget]Fixed
    Details (2)

    • 1.21.3-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.21.3-1+deb12u1

      usn · wget · debian · bookworm; usn · wget · debian · 12

    • 1.21.3-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.21.3-1+deb12u1

      usn · wget · debian · bookworm; usn · wget · debian · 12

[Debian 13 (Trixie)]

  • [wget]Fixed
    Details (2)

    • 1.25.0-2 · amd64 · trixie

      Fixed · Fixed: 1.24.5-2

      usn · wget · debian · 13

    • 1.25.0-2 · arm64 · trixie

      Fixed · Fixed: 1.24.5-2

      usn · wget · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]