Too late to edit my comment, but: TLS 1.3 and HTTP/2 have padding frames: https://tlswg.github.io/tls13-spec/#rfc.section.5.4 - applications that use padding will likely prevent these attacks.