Home Assistant’s Supervisor stops a long, carefully shaped request address from tying up its request-handling loop. The security filter runs before authentication, so the costly check could interrupt other work before the sender had signed in.
Manuel Rüger’s correction keeps the scan’s work proportional to the address length. Reported tests of 24 KB requests took 0.2 to 2.4 milliseconds rather than minutes; comparisons across 800,000 generated inputs found no change in what the filter blocked.