#2 slowloris attack vulnerability

[Mark Hobley]

The chttpd server may be vulnerable to a slowloris attack.

[John M. Jones]

An obvious way to prevent such an attack is to limit the number of simultaneous connections a client can have open with incomplete headers.

That's the obvious way, but perhaps not the best, and definitely not the only. I'm interested in others' thoughts.