Bug report's comments says wget does too, and you can't turn it off.
https://security-tracker.debian.org/tracker/CVE-2018-20483
https://lists.gnu.org/archive/html/bug-wget/2018-12/msg00034...
After @marcan42 noted this wasn't obvious for users: https://twitter.com/marcan42/status/1077676739877232640