Chromium 25.0.1364.160 (debian testing), Iceweasel/Firefox 19 and probably many other browsers allow javascript to set broken cookie values, leading to possible permanent "400 Bad Request" responses. The broken value might be set by 3rd party libraries. For example the google analytics code is vulnerable, as it sets cookie values based on parameters in the referer query string. lighttpd does not allow control characters in http header values, so any lighttpd site using google analytics is vulnerable if you can get the user to follow a link (img tag for example) to that site like this: http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st Afaik apache doesn't check the cookie values (or perhaps removes the broken characters). Imho they are responsible for this mess :) To be clear: the bug is in the browser / javascript implementation: document.cookie MUST NOT allow cookie values which include certain control characters. Javascript applications should not use 8-bit characters. (If browser vendors want to allow broken cookie values to be stored, they MUST NOT send them to the server; in this case javascript applications can still read the broken values. But I don't think this is a good idea.) The safe character set for HTTP header values is: %x20-7E; %x80-FF is obsoleted by the current draft. "A recipient MAY replace any linear white space with a single SP before interpreting the field value", so horizontal tabs are not "safe" - they might get converted to a space, but are not forbidden (also multiple spaces can get replaced by a single one). I think this could use a CVE. The problem was reported in our lighttpd bug tracker: http://redmine.lighttpd.net/issues/2188 Kind regards, Stefan Testing the bug: Try one of the listed urls in the ticket (the error should trigger after a reload). If you have noscript, request policy, referer control or similar stuff running you are probably safe; to test the bug in this case you need a Javascript console on a lighttpd site (http://lighttpd.net for example), and enter: document.cookie = "foo=bar\x05test" Try to reload the page - it should return a 400 Bad Request page now. document.cookie = "foo=" And it should work again. HTTP references: http://tools.ietf.org/html/rfc2616 message-header = field-name ":" [ field-value ] field-name = token field-value = *( field-content | LWS ) field-content = *TEXT | *(token | separators | quoted-string) LWS = [CRLF] 1*( SP | HTAB ) # TEXT is superset of (token | separators | quoted-string) TEXT = LWS | %x21-7E | %x80-FF http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-22 header-field = field-name ":" OWS field-value BWS field-name = token field-value = *( field-content / obs-fold ) field-content = *( HTAB / SP / VCHAR / obs-text ) obs-fold = CRLF ( SP / HTAB ) # obsolete text obs-text = %x80-FF Basic definitions: # horizontal tab HTAB = %x09 # space SP = %x20 # visible ASCII VCHAR = %x21-7E # carriage return + line feed CRLF = %0x0D %0x0A