@khm @dalias I didn't try confirming it was exploitable because his ego is so fragile he'd probably want to sue me for it. And he updated to a new version of Apache (without known critical CVEs) after I published my post, btw, so in the end I helped him

Update: He has updated Apache to 2.4.65! Public disclosure after getting privately ignore works, it turns out

I told Joshua Aaron, developer of ICEBlock, that he was running a vulnerable version of Apache on his server. He ignored my vulnerability report and blocked me, and his service is still vulnerable today https://micahflee.com/iceblock-handled-my-vulnerability-report-in-the-worst-possible-way/

Italian dockworkers threaten Israel cargo ban if Gaza flotilla blocked https://www.politico.eu/article/italian-dockworkers-threaten-israel-cargo-ban-gaza-flotilla-departs-genova/