[Pkg-nginx-maintainers] Bug#1143087: Nginx: Possible log forgery when using error_log

[Andrzej]

Package: nginx
Version: 1.26.3-3+deb13u7

When using the error_log directive, a newline character in the URL (%0a) is
logged directly, without escaping.
As a result, it is possible to inject false entries into the server log.

Example configuration:
server {
  server_name example;
  access_log /var/log/nginx/example.log;
  error_log /var/log/nginx/example.err;
}

Request:
curl '
http://example/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20'

Log:
2026/07/30 11:38:57 [error] 7608#7608: *58 open() "/usr/share/nginx/html/
2026/07/30 13:66:66 oops
2026/07/30 13:66:66 " failed (2: No such file or directory), client:
127.0.0.1, server: example, request: "GET
/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20 HTTP/1.1",
host: "example"



Pozdrawiam/Regards,
Andrzej Borsuk
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-nginx-maintainers/attachments/20260730/ce9f3d5c/attachment.htm>