The attached pcap processed with bro -r pcapname will demonstrate the issue. View the http.log after processing and note that the field delimiter appears within a field.
I tried searching the official github mirror but don't know bro well enough to find the spot to look. I'd be happy to work on fixing this if you point me to the problem area (that's the hard part, right?)
ubuntu 12.04LTS server
Which line in http.log are you specifically referring to? I don't see any problems with this log. We specifically handle the case of field separators within fields by hex escaping.
Could not reproduce the problem.