BusyBox wget versions up to 1.3.7 improperly handle raw CR (0x0D), LF (0x0A), and other C0 control characters in the HTTP request-target (path/query). This flaw allows an attacker to split the HTTP request line and inject arbitrary headers by exploiting the acceptance of these control bytes. The vulnerability arises because wget does not reject raw spaces (0x20) in the request-target, which should be encoded as %20 to maintain the HTTP/1.1 request-line format 'METHOD SP request-target SP HTTP/1.1'. This can lead to header injection attacks. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity. No patch or vendor advisory is currently available.

An attacker can exploit this vulnerability to inject arbitrary HTTP headers by splitting the HTTP request line, potentially leading to information disclosure or manipulation of HTTP requests made by BusyBox wget. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions of BusyBox wget or implement network-level controls to detect and block malicious HTTP request patterns that include raw CR/LF characters in request-targets. Encoding spaces as %20 in URLs is recommended to avoid triggering the vulnerability.