Just want to thank you for publishing this and taking the time to present it in such a clear manner. As someone who has implemented HTTP/1.1 message parsing my

Just want to thank you for publishing this and taking the time to present it in such a clear manner. As someone who has implemented HTTP/1.1 message parsing myself, it blows my mind how downgrade implementers could've made such basic mistakes as to not validate the contents of headers. The companies selling security software with these mistakes should be held accountable IMHO, as the attacks are so simple and so many that they've probably been exploited extensively in the wild, and similar attacks almost certainly continue to be.