After reading the article, I can conclude that Codex discovered nothing new.
This is already something that is known, and if you're able to be targeted by this (which is not the majority of users) configure your httpd differently.
swedishuser 10 hours ago [-]
Apache and nginx maintainers implemented fixes one or two days after the author reported, so how do you mean this was known already?
BobbyTables2 17 hours ago [-]
Couldn’t simple fuzzing have found this?
pixel_popping 12 hours ago [-]
Not really, as it wasn't found for close to a decade (>5 years for most webservers).
I was about to say, the bug here isn't in the protocol, it's that memory use isn't being counted & limited as it should... and, yeah.
I'm a bit surprised this happened to Apache, though. APR uses pool allocators. That should be easy enough to track and limit...
This appears to be fixed as of April (at least for Apache). [0].
[0] - https://github.com/nginx/nginx/commit/365694160a85229a7cb006...
This is already something that is known, and if you're able to be targeted by this (which is not the majority of users) configure your httpd differently.