The sort of hypothetical security vulnerability here is likely to depend on undefined behaviour (buffer over-runs, subverting parsers, etc etc). Just another reason to continue moving over to safe languages, especially for the lower level bits of our stacks. HTTP is big and complicated, I'm much happier exposing Rust/Go/C#/... to it than I am exposing C to it.
In safe languages, backdoors must be far more explicit, so we close off the likely scenario posited here.
In safe languages, backdoors must be far more explicit, so we close off the likely scenario posited here.