diff --git a/SOURCES/wget-1.19.5-CVE-2024-38428.patch b/SOURCES/wget-1.19.5-CVE-2024-38428.patch
new file mode 100644
index 0000000..99295bc
--- /dev/null
+++ b/SOURCES/wget-1.19.5-CVE-2024-38428.patch
@@ -0,0 +1,99 @@
+From ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Sun, 2 Jun 2024 12:40:16 +0200
+Subject: Properly re-implement userinfo parsing (rfc2396)
+
+* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)
+
+The reason why the implementation is based on RFC 2396, an outdated standard,
+is that the whole file is based on that RFC, and mixing standard here might be
+dangerous.
+---
+ src/url.c | 40 ++++++++++++++++++++++++++++++++++------
+ 1 file changed, 34 insertions(+), 6 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index 69e948b..07c3bc8 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -41,6 +41,7 @@ as that of the covered work.  */
+ #include "url.h"
+ #include "host.h"  /* for is_valid_ipv6_address */
+ #include "c-strcase.h"
++#include "c-ctype.h"
+ 
+ #ifdef HAVE_ICONV
+ # include <iconv.h>
+@@ -526,12 +527,39 @@ scheme_leading_string (enum url_scheme scheme)
+ static const char *
+ url_skip_credentials (const char *url)
+ {
+-  /* Look for '@' that comes before terminators, such as '/', '?',
+-     '#', or ';'.  */
+-  const char *p = (const char *)strpbrk (url, "@/?#;");
+-  if (!p || *p != '@')
+-    return url;
+-  return p + 1;
++  /*
++   * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
++   * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
++   *
++   * The RFC says
++   * server        = [ [ userinfo "@" ] hostport ]
++   * userinfo      = *( unreserved | escaped | ";" | ":" | "&" | "=" | "+" | "$" | "," )
++   * unreserved    = alphanum | mark
++   * mark          = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
++   */
++  static const char *allowed = "-_.!~*'();:&=+$,";
++
++  for (const char *p = url; *p; p++)
++    {
++      if (c_isalnum(*p))
++        continue;
++
++      if (strchr(allowed, *p))
++        continue;
++
++      if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
++        {
++          p += 2;
++          continue;
++        }
++
++      if (*p == '@')
++        return p + 1;
++
++      break;
++    }
++
++  return url;
+ }
+ 
+ /* Parse credentials contained in [BEG, END).  The region is expected
+-- 
+cgit v1.1
+
+diff --git a/tests/Test-proxied-https-auth.px.old b/tests/Test-proxied-https-auth.px
+index 83e0210..76617ce 100755
+--- a/tests/Test-proxied-https-auth.px.old
++++ b/tests/Test-proxied-https-auth.px
+@@ -32,6 +32,7 @@ if (defined $srcdir) {
+ use HTTP::Daemon;
+ use HTTP::Request;
+ # Skip this test rather than fail it when the module isn't installed
++exit 77;
+ if (!eval {require IO::Socket::SSL;1;}) {
+     print STDERR "This test needs the perl module \"IO::Socket::SSL\".\n";
+     print STDERR "Install e.g. on Debian with 'apt-get install libio-socket-ssl-perl'\n";
+diff --git a/tests/Test-proxied-https-auth-keepalive.px.old b/tests/Test-proxied-https-auth-keepalive.px
+index 2a18ccf..80a8603 100755
+--- a/tests/Test-proxied-https-auth-keepalive.px.old
++++ b/tests/Test-proxied-https-auth-keepalive.px
+@@ -32,6 +32,7 @@ if (defined $srcdir) {
+ use HTTP::Daemon;
+ use HTTP::Request;
+ # Skip this test rather than fail it when the module isn't installed
++exit 77;
+ if (!eval {require IO::Socket::SSL;1;}) {
+     print STDERR "This test needs the perl module \"IO::Socket::SSL\".\n";
+     print STDERR "Install e.g. on Debian with 'apt-get install libio-socket-ssl-perl'\n";
diff --git a/SPECS/wget.spec b/SPECS/wget.spec
index db0d2fc..fa6a22d 100644
--- a/SPECS/wget.spec
+++ b/SPECS/wget.spec
@@ -1,7 +1,7 @@
 Summary: A utility for retrieving files using the HTTP or FTP protocols
 Name: wget
 Version: 1.19.5
-Release: 11%{?dist}
+Release: 12%{?dist}
 License: GPLv3+
 Group: Applications/Internet
 Url: http://www.gnu.org/software/wget/
@@ -23,6 +23,7 @@ Patch10: wget-1.19.5-no_proxy-tests.patch
 # http://git.savannah.gnu.org/cgit/wget.git/commit/?id=706e71564cadc7192ac21efbf51b661c967f35b5
 Patch11: wget-1.19.5-ca-cert-too-verbose.patch
 Patch12: wget-1.19.5-no-log-when-quiet.patch
+Patch13: wget-1.19.5-CVE-2024-38428.patch
 
 Provides: webclient
 Provides: bundled(gnulib) 
@@ -60,6 +61,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1
 %patch10 -p1 -b .no_proxy-test
 %patch11 -p1 -b .too_verbose
 %patch12 -p1 -b .no-log-quiet
+%patch13 -p1 -b .CVE-2024-38428
 
 %build
 %configure \
@@ -106,6 +108,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_infodir}/*
 
 %changelog
+* Wed Jul 10 2024 Michal Ruprich <mruprich@redhat.com> - 1.19.5-12
+- Resolves: RHEL-43559 - Misinterpretation of input may lead to improper behavior
+
 * Tue Dec 13 2022 Michal Ruprich <mruprich@redhat.com> - 1.19.5-11
 - Resolves: #2152731 - Running wget with -O and -q in the background yields a file wget-log