Description
CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
References (4)
Scores
CVSS v3
6.1
EPSS
0.0015
EPSS Percentile
34.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-93
Status
published
Products (1)
gnu/wget
< 1.19.1
Published
Mar 07, 2017
Tracked Since
Feb 18, 2026