defnull/bottle — comment on commit 6946695b69f5493fb063c351400ff759323a31aa
File:  line 0
By defnull:

Yes, but some attack vectors are simply out of my control. You can for example fake http headers and cause collisions in the environ dict. My workaround reduces the risk, but fixing the bug is up to CPython.