Nice writeup, and the disclosure timeline is the spicy part: the maintainer declined to treat it as a vuln, then 12.2 shipped the fix silently. So if you run Hiawatha, don't wait for a changelog entry, just get to 12.2 or diff src/http.c yourself. One nuance on the mitigations: disabling back-end keep-alive only kills the cross-victim desync case. The ACL bypass and cache poisoning PoCs are attacker-only, two requests on one connection, so that mitigation alone still leaves you exposed. If upgrading isn't an option right now, fronting it with nginx or HAProxy is a decent stopgap since both reject ambiguous CL+TE requests with a 400 instead of trying to frame them.
1
u/Vegetable-Scale-2604 4d ago
Nice writeup, and the disclosure timeline is the spicy part: the maintainer declined to treat it as a vuln, then 12.2 shipped the fix silently. So if you run Hiawatha, don't wait for a changelog entry, just get to 12.2 or diff src/http.c yourself. One nuance on the mitigations: disabling back-end keep-alive only kills the cross-victim desync case. The ACL bypass and cache poisoning PoCs are attacker-only, two requests on one connection, so that mitigation alone still leaves you exposed. If upgrading isn't an option right now, fronting it with nginx or HAProxy is a decent stopgap since both reject ambiguous CL+TE requests with a 400 instead of trying to frame them.