<story><title>Nginx security advisory (CVE-2013-4547)</title><url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url></story><parent_chain></parent_chain><comment><author>casca</author><text>Workaround:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    if ($request_uri ~ &amp;quot; &amp;quot;) {
        return 403;
    }
&lt;/code&gt;&lt;/pre&gt;
The issue is the handling of unescaped spaces. These are illegal but nginx accepts them. The workaround is to throw an error any time someone sends the invalid space.</text></comment>
<story><title>Nginx security advisory (CVE-2013-4547)</title><url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url></story><parent_chain></parent_chain><comment><author>staunch</author><text>A better link: &lt;a href=&quot;http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;mailman.nginx.org&amp;#x2F;pipermail&amp;#x2F;nginx-announce&amp;#x2F;2013&amp;#x2F;00012...&lt;/a&gt;</text></comment>