Comment by ArcHound

I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.

So as a hotfix I block this on my reverse proxy.