Not necessarily. Everyone saying HTTP/1.1 is simple has never implemented a full real-world-compatible parser for it. HTTP/1 has lots of unobvious edge cases,

Not necessarily. Everyone saying HTTP/1.1 is simple has never implemented a full real-world-compatible parser for it. HTTP/1 has lots of unobvious edge cases, and legacy quirks. Text format has way more flexibility than it seems from valid headers. It has obscure features like multi-line headers and old MIME features, 100-continue race conditions, custom hop-by-hop headers, GET bodies. Fortunately new HTTP RFCs document many pitfalls. If you just implement what RFC 2616 said, you won't have a safe implementation. Actual size of a request or response can be specified in multiple ways (at the same time, with conflicting values), and depends on a combination of several features, and values of headers with weird parsing rules needed for backwards compat, so "simple" HTTP implementations can be tricked into request smuggling. Either way you need a robust, well-tested mature implementation.