Still using? Apache 2.4 is the current version. Apache is far from perfect, but among its ilk it is probably the one of the more robust and well tested. It's n

Still using? Apache 2.4 is the current version. Apache is far from perfect, but among its ilk it is probably the one of the more robust and well tested. It's not as if you don't have to care about connection hogging attacks such as slowloris with other http servers. The cycles saved on the nginx http parser, which is completely irrelevant to the performance of any real world web application, comes at the price of being hand optimized and opaque. You can't really argue for that type of performance engineering at the same time as you argue for solid security. The world generally needs more secure software, not more performant protocol parsers. Do also note that nginx had a very similar data leak bug not even two months ago in the range header.