Rouille, another Rust HTTP server, can also trivially be DOS'd by sending a Content-Length that doesn't match the actual content length.

But HTTP implementations like these are not really meant to directly face the internet. They usually sit behind reverse proxies/API gateways/CDNs.