The Asf

An unauthenticated client can control ImageMagick convert arguments through the experimental magick plugin when using the default unsigned configuration. This issue may allow cache poisoning and request smuggling.

An issue exists where a truncated HTTP/2 Content-Length value can be used to exhaust the worker pool of an HTTP/1.1 origin.

A malformed padded HTTP/2 DATA frame can be used to exhaust the worker pool of an HTTP/1.1 origin.