Security researcher Muneaki Nishimura discovered a flaw in
the Mozilla's HTTP
Alternative Services implementation. If an Alt-Svc header is
specified in the HTTP/2 response, SSL certificate verification can be bypassed
for the specified alternate server. As a result of this, warnings of invalid SSL
certificates will not be displayed and an attacker could potentially impersonate
another site through a man-in-the-middle (MTIM), replacing the original
certificate with their own.
Vulmon