@khm @dalias I didn't try confirming it was exploitable because his ego is so fragile he'd probably want to sue me for it. And he updated to a new version of Apache (without known critical CVEs) after I published my post, btw, so in the end I helped him