Hmm... maybe difficult to verify, since I did not post a PoC test.
Maybe a kind Oracle admin could point me to a patched fcgi-bin/echo?
Funny if any such existed: an admin careful to keep patches up-to-date, but
careless in not following security recommendations to remove...
Maybe, contact me off-list so I can provide PoC?