CVE-2013-4547: nginx URI space character restriction bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 7.5 and high EPSS percentile indicate significant risk, though no known active exploitation in KEV.

What it is

nginx versions 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 fail to properly handle an unescaped space character in a URI, allowing attackers to bypass intended access restrictions. This can expose resources that should be protected by location or access rules, undermining the server's security controls.

Impact

An attacker can bypass intended restrictions to access or manipulate resources that should be blocked, potentially leading to unauthorized information disclosure or modification. The CVSS vector indicates partial confidentiality, integrity, and availability impact.

Attack surface

The flaw is reachable remotely over the network via a crafted HTTP request containing an unescaped space in the URI. No authentication or user interaction is required, as indicated by the AV:N/AC:L/Au:N vector.

Exploitation

The vulnerability is not listed in CISA KEV and no ransomware groups are documented using it. EPSS probability is 0.67718 (99.281 percentile), indicating a high likelihood of exploitation activity, though no public exploit references are tagged in the record.

What to do

• Upgrade nginx to version 1.4.4 or 1.5.7 or later, which contain the fix.
• Apply vendor patches or updates from SUSE, openSUSE, or F5 for affected products.
• Review and tighten nginx configuration rules that rely on URI parsing to ensure they are not bypassable.
• Monitor vendor advisories for any additional mitigations or workarounds.

Detection

• Inspect HTTP request logs for URIs containing unescaped space characters or unusual encoding patterns.
• Use web application firewall (WAF) rules to detect and block requests with malformed URIs.
• Correlate access logs with known nginx location or access control bypass attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.