> It is translation to the, from a security point of view, problematic HTTP/1 that is the problem. Parts of the HTTP/2 spec. specify what malformed headers loo

> It is translation to the, from a security point of view, problematic HTTP/1 that is the problem. Parts of the HTTP/2 spec. specify what malformed headers look like, so this bug is almost entirely in the code not validating those HTTP/2 headers. This also isn't something that a few high school dropouts got wrong on their side projects, several major services got it wrong. Given that the spec. made at least some attempts to warn its implementers maybe future standards need a security section titled "Important: Why ignoring security advisory in standards is a bad idea".