On Lucee 7.0.4.34, we get noise in the application log from bots & scanners sending malformed requests. These exceptions that are getting logged do not impact the page (the page still succeeds and returns a 200), but they do cause clutter in the application.log. Could these be quieted?
I’m attaching a .cfm file that reproduces the problem.
reproduce-decode-error.cfm (4.3 KB)
Here are what the exceptions look like:
"ERROR","http-nio-8888-exec-3","06/10/2026","15:01:29","http://127.0.0.1:8888","encoding","Invalid URL encoding in string [<%@ test via POST]lucee.runtime.exp.ApplicationException: Invalid URL encoding in string [<%@ test via POST]
at lucee.commons.net.URLDecoder.decode(URLDecoder.java:64)
at lucee.runtime.type.scope.ScopeSupport.fillDecoded(ScopeSupport.java:182)
at lucee.runtime.type.scope.FormImpl.initializeUrlEncodedOrTextPlain(FormImpl.java:301)
at lucee.runtime.type.scope.FormImpl.initialize(FormImpl.java:143)
at lucee.runtime.PageContextImpl.formScope(PageContextImpl.java:1472)
at lucee.runtime.type.scope.UndefinedImpl.reinitialize(UndefinedImpl.java:650)
at lucee.runtime.type.scope.UndefinedImpl.initialize(UndefinedImpl.java:630)
at lucee.runtime.type.scope.UndefinedImpl.initialize(UndefinedImpl.java:600)
at lucee.runtime.PageContextImpl.initialize(PageContextImpl.java:579)
at lucee.runtime.CFMLFactoryImpl.getPageContextImpl(CFMLFactoryImpl.java:248)
at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1201)
at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1190)
at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:99)
at lucee.loader.servlet.jakarta.CFMLServlet.service(CFMLServlet.java:41)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:128)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:165)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:113)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83)
at mod_cfml.core.invoke(core.java:180)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:782)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1272)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1801)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:946)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:480)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:57)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.apache.commons.codec.DecoderException: Invalid URL encoding: not a valid digit (radix 16): 64
at org.apache.commons.codec.net.Utils.digit16(Utils.java:49)
at org.apache.commons.codec.net.URLCodec.decodeUrl(URLCodec.java:178)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:216)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:280)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:300)
at lucee.commons.net.URLDecoder.decode(URLDecoder.java:59)
... 35 more
"
"ERROR","http-nio-8888-exec-9","06/10/2026","15:01:29","http://127.0.0.1:8888","encoding","Invalid URL encoding in string [%@test_via_GET]lucee.runtime.exp.ApplicationException: Invalid URL encoding in string [%@test_via_GET]
at lucee.commons.net.URLDecoder.decode(URLDecoder.java:64)
at lucee.runtime.type.scope.ScopeSupport.fillDecoded(ScopeSupport.java:182)
at lucee.runtime.type.scope.URLImpl.initialize(URLImpl.java:74)
at lucee.runtime.PageContextImpl.urlScope(PageContextImpl.java:1466)
at lucee.runtime.type.scope.UndefinedImpl.reinitialize(UndefinedImpl.java:649)
at lucee.runtime.type.scope.UndefinedImpl.initialize(UndefinedImpl.java:630)
at lucee.runtime.type.scope.UndefinedImpl.initialize(UndefinedImpl.java:600)
at lucee.runtime.PageContextImpl.initialize(PageContextImpl.java:579)
at lucee.runtime.CFMLFactoryImpl.getPageContextImpl(CFMLFactoryImpl.java:248)
at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1201)
at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1190)
at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:99)
at lucee.loader.servlet.jakarta.CFMLServlet.service(CFMLServlet.java:41)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:128)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:165)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:113)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83)
at mod_cfml.core.invoke(core.java:180)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:782)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1272)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1801)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:946)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:480)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:57)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.apache.commons.codec.DecoderException: Invalid URL encoding: not a valid digit (radix 16): 64
at org.apache.commons.codec.net.Utils.digit16(Utils.java:49)
at org.apache.commons.codec.net.URLCodec.decodeUrl(URLCodec.java:178)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:216)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:280)
at org.apache.commons.codec.net.URLCodec.decode(URLCodec.java:300)
at lucee.commons.net.URLDecoder.decode(URLDecoder.java:59)
... 34 more
"