[d_meeze]

Burying the lede... Unfortunately, at the time of this whitepaper being published - 86 days after Apache was notified of the vulnerability - 2.4.49 not yet come out, so although there's a patch on master, this is effectively a zero-day.

[slivanes]

I'm not seeing anything about this in nginx changelogs (or matching CVE's) either. Disabling http2 for now.

[yxhuvud]

Why would an Apache bug show up in Nginx changelogs?

[masklinn]

It would not, but given how widespread this issue is it seems likely nginx is vulnerable, and sensible to assume it is unless otherwise demonstrated.

It’s not like the feature is super useful in general.