{"id":"CVE-2020-36309","aliases":["BIT-openresty-2020-36309","CLSA-2026-1780912663","DEBIAN-CVE-2020-36309","DLA-4228-1","EUVD-2020-23851","GHSA-j8m6-95xp-pmp6","UBUNTU-CVE-2020-36309","USN-5371-1"],"status":"published","title":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters...","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01423,"percentile":0.73237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-04-06T17:32:45Z","modified":"2026-11-05T19:01:03Z","fixes":[{"ecosystem":"Bitnami","package":"openresty","fixed_in":["0.10.16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"openresty","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els8"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6.1+deb11u5"}]}],"versions":["1.18.0-6.1","1.18.0-6.1+deb11u1","1.18.0-6.1+deb11u2","1.18.0-6.1+deb11u3","1.18.0-6.1+deb11u4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8","1.4.6-1ubuntu3.9+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm3"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.10"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.3"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm3"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.10"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.3"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2"],"bundled":3}],"products":[{"vendor":"openresty","product":"lua-nginx-module"}],"references":[{"url":"https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://github.com/openresty/lua-nginx-module/pull/1654","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://news.ycombinator.com/item?id=26712562","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36309","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0005"},{"url":"https://github.com/advisories/GHSA-j8m6-95xp-pmp6"},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1780912663.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32647","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-36309","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-36309","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5371-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3618","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T17:32:45Z","modified":"2025-11-03T19:25:36.582Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-23851","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T17:32:45Z","modified":"2025-11-03T19:25:36Z","updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-j8m6-95xp-pmp6","title":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters...","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2022-05-24T17:46:36Z","modified":"2025-11-03T21:30:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:04:18.176646Z"}],"nvd":[{"id":"CVE-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T19:15:13.583Z","modified":"2026-06-17T03:15:16.563Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T19:15:13.583Z","modified":"2026-10-20T10:53:25.797551947Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T19:15:13.583Z","modified":"2026-10-26T12:02:49.306367531Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2021-04-06T19:15:00Z","modified":"2026-11-05T19:01:03.382785196Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T19:27:36.688147Z"},{"id":"BIT-openresty-2020-36309","description":"ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.","status":"published","published":"2024-03-06T10:59:59.208Z","modified":"2026-09-08T08:48:24.496951965Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"CLSA-2026-1780912663","title":"Fix of 6 CVEs","description":"   * SECURITY UPDATE: detect premature plain text response from SSL upstream (TLS plaintext injection)\n     - debian/patches/CVE-2026-1642.patch: detect premature plain text response from SSL upstream (TLS plaintext injection)\n     - CVE-2026-1642\n   * SECURITY UPDATE: fix NULL pointer dereference clearing s-\u003epasswd in mail auth http requests\n     - debian/patches/CVE-2026-27651.patch: fix NULL pointer dereference clearing s-\u003epasswd in mail auth http requests\n     - CVE-2026-27651\n   * SECURITY UPDATE: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)\n     - debian/patches/CVE-2026-27654.patch: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)\n     - CVE-2026-27654\n   * SECURITY UPDATE: fix integer overflow on 32-bit platforms in ngx_http_mp4_module\n     - debian/patches/CVE-2026-27784.patch: fix integer overflow on 32-bit platforms in ngx_http_mp4_module\n     - CVE-2026-27784\n   * SECURITY UPDATE: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)\n     - debian/patches/CVE-2026-32647.patch: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)\n     - CVE-2026-32647\n   * SECURITY UPDATE: reject unsafe characters in URIs and headers set via the Lua API (HTTP response splitting)\n     - debian/modules/nginx-lua/src/ngx_http_lua_util.c,\n       debian/modules/nginx-lua/src/ngx_http_lua_util.h,\n       debian/modules/nginx-lua/src/ngx_http_lua_uri.c,\n       debian/modules/nginx-lua/src/ngx_http_lua_headers_in.c,\n       debian/modules/nginx-lua/src/ngx_http_lua_headers_out.c,\n       debian/modules/nginx-lua/src/ngx_http_lua_control.c: validate\n       arguments of the Lua APIs that mutate a URI or a request/response\n       header so control characters raise an error instead of being\n       silently truncated.\n     - CVE-2020-36309","status":"published","published":"2026-06-08T09:58:07Z","modified":"2026-10-26T09:43:35.555425527Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"DLA-4228-1","title":"nginx - security update","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-03-09T01:20:57.808777Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-5371-1","title":"nginx vulnerabilities","description":"It was discovered that nginx Lua module mishandled certain inputs.\nAn attacker could possibly use this issue to perform an HTTP Request\nSmuggling attack. This issue was fixed for Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-11724)\n\nIt was discovered that nginx Lua module mishandled certain inputs.\nAn attacker could possibly use this issue to disclose sensitive\ninformation. This issue only affects Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-36309)\n\nIt was discovered that nginx mishandled the use of \ncompatible certificates among multiple encryption protocols. \nIf a remote attacker were able to intercept the communication, \nthis issue could be used to redirect traffic between subdomains.\n(CVE-2021-3618)\n","status":"published","published":"2022-04-12T15:48:57Z","modified":"2026-06-25T13:31:07.553074253Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}