---
title: "AH10411: Rewritten query string contains control characters or spaces"
canonical_url: "https://www.zone.lv/help/kb/ah10411-rewritten-query-string-contains-control-characters-or-spaces-2/"
post_type: "ht_kb"
published: "2024-04-04T06:38:54+00:00"
modified: "2024-04-04T06:38:54+00:00"
language: "en"
author: "silver"
taxonomies:
  ht_kb_category:
    - name: "Apache"
      url: "https://www.zone.lv/help/kb-categories/apache-en/"
  ht_kb_tag:
    - name: "apache"
      url: "https://www.zone.lv/help/kb-tags/apache-eng/"
---

# AH10411: Rewritten query string contains control characters or spaces

Due to the patching of the [CVE-2023-25690](https://nvd.nist.gov/vuln/detail/CVE-2023-25690) (CVSS score 9.8) vulnerability discovered in the Apache web server software, some Rewrite rules may have broken, now giving an error:

```
AH10411: Rewritten query string contains control characters or spaces
```

This usually happens if the address bar contains a space (`%20`).

To solve the problem, the `BCTLS` flag should be added to the end of the `RewriteRule` rule.

If, for example, the Rewrite rule is currently in use:

```
RewriteRule ^([^?]*) index.php?route=$1 [L,QSA]
```

Then this rule should be changed to:

```
RewriteRule ^([^?]*) index.php?route=$1 [BCTLS,L,QSA]
```

If there are no square brackets at the end of the RewriteRule line, the `BCTLS` flag must be added to the end of the line with the square brackets:` [BCTLS]`

 NB! Since the security vulnerability is mainly related to proxy queries (if your RewriteRule has a `P` flag), there is no point in adding a `[BCTLS]` flag to RewriteRule rows that do not generate errors.