Apache 404 fails with /boot.ini%2500.htm

For some reason the following htaccess will redirect to a 404 page if the tested url is /boot.ini.htm but not if it is /boot.ini%2500.htm.

What do I need to change to make this work or is this a bug?

Options All -Indexes
Options +FollowSymlinks

ErrorDocument 403 /site/404
ErrorDocument 404 /site/404

RewriteEngine On

RewriteRule ^(fonts)($|/) - [L]

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [L,R=301]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([\s\S]*)$ index.php/$1 [L,NC,QSA]

# Ensure Authorization header is passed along
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

ServerSignature Off

php_value memory_limit 256M

My server is:

Server version: Apache/2.4.41 (Ubuntu)

Server built: 2021-06-17T18:27:53

In all instances I am seeing the default Apache 404 response

In that case the request is certainly not being processed by Codeigniter. It looks like the 404 is being triggered by the Apache server, before .htaccess is even processed. This is quite likely triggered by something like mod_security (there might be some clue in the HTTP response headers).

URLs that contain % can potentially pose a security threat. So it wouldn't necessarily be that unusual to have a blanket rule on the server that simply blocks these requests. Unless you have access to the server config in some form then it's unlikely you can do anything to influence this.

But it is already returning a 404. And a 404 is a 404 after all, so it's not going to make any difference to bots. And real users should never be making such requests anyway.