Product: BusyBox (wget) Affected: through 1.37.0 File: networking/wget.c
CWE: 113
Summary: If the request-target (path/query) contains raw CR/LF/C0 or a raw space (0x20), the HTTP request line can be split and attacker-chosen headers injected, enabling cache poisoning / policy bypass.
Vector: A user or automated job fetches a crafted URL that includes CR/LF in the path/query (e.g., via link or redirect).
Mitigation: Reject CR/LF/C0 and raw 0x20 in the request-target; callers should percent-encode (%0D, %0A, %20).