Why would I patch this in an environment where I only trust certificates that I control and distribute? And in environments where TLS session handling is done i

Why would I patch this in an environment where I only trust certificates that I control and distribute? And in environments where TLS session handling is done in a process with stack cookies (assuming I verify there's a cookie on this function)? The reason to have these descriptions is to assess whether this threat applies to you. If I were in another position I would care a lot, but I'm not. I'll likely patch anyways because this bug may end up being a useful primitive in a larger chain of bugs (kinda doubt it tho tbh), and for me patching is not hard, but at scale, given this threat model, I would not necessarily trigger an out of cycle patch.