Oversized UTF-8 sequences are not blocking, making it possible to conduct cross-site scripting and directory traversal attacks.