Medium severity5.3NVD Advisory· Published Apr 6, 2021· Updated Jun 17, 2026
CVE-2020-36309
CVE-2020-36309
Description
ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:openresty:lua-nginx-module:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openresty:lua-nginx-module:*:*:*:*:*:*:*:*range: <0.10.16
- (no CPE)range: <0.10.16
- OpenResty/ngx_http_lua_moduledescription
Patches
Vulnerability mechanics
References
5- github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16nvdPatchThird Party Advisory
- github.com/openresty/lua-nginx-module/pull/1654nvdPatchThird Party Advisory
- news.ycombinator.com/itemnvdThird Party Advisory
- security.netapp.com/advisory/ntap-20210507-0005/nvdThird Party Advisory
- lists.debian.org/debian-lts-announce/2025/06/msg00026.htmlnvd
News mentions
0No linked articles in our index yet.