It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. References: http://seclists.org/oss-sec/2016/q4/322
Created lynx tracking bugs for this issue: Affects: fedora-all [bug 1391862]