[AtNightWeCode]

If this is true than the design is problematic. What makes it even worse is that cancellation of requests typically does not work in cloud environments. It is a bit laughable that Azure for instance recommend the use of cancellation tokens but in reality you never get them for web requests.

[carstenhag]

Look at F5's entry regarding this CVE. They specifically mention they have set a safer limit because they expected this to be an attack vector, haha