Upon researching this, "() {" will always catch this. If you look at the bash source code, the relevant parsing function checks if an environment variable begi

Upon researching this, "() {" will always catch this. If you look at the bash source code, the relevant parsing function checks if an environment variable begins with the literal 4-character string of "() {". That's why it's pretty easy to detect exploits: you can't do anything to evade a filter checking for this in an HTTP header. An HTTP server should not be doing any decoding of an HTTP header that could result in "() {" being obfuscated. This may not apply for attacks against things that aren't web apps, though.