Comment by truelson

So, uh, isn’t the blast radius huge here? Like ticking time bomb for unpatched servers huge once someone figures out how to craft their br payload just right?

Browsers were patched back in March, but if you can get anything else that is unpatched to decode br, and most HTTP clients do by default, and you’ve figured out the right payload (yes not easy, but still), isn’t this, well, really bad? Like Heartbleed big?