this was rejected https://nvd.nist.gov/vuln/detail/CVE-2022-3638 (cherry picked from commit 08d1f1bb)