-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the url_skip_credentials function in src/url.c. The original code used strpbrk with a set of delimiters including ';'. This caused the function to incorrectly terminate parsing of the userinfo string if a semicolon was encountered before an '@', even though semicolons are valid characters within userinfo according to RFC 2396. This misinterpretation could lead to parts of the userinfo being treated as the hostname. The patch modifies url_skip_credentials to correctly loop through characters allowed in userinfo (including semicolons) until an '@' is found or an invalid character for userinfo is encountered, thus correctly identifying the boundary between userinfo and the host. The commit information could not be fetched directly via the tool, so the analysis is based on the content of the commit URL provided, which includes the code diff for the affected file and function.