CVE-2026-115877: Http Header Value Screen Rejects Nul But Not Cr Lfcve-2026-115877-http-header-value-screen-rejects-nul-but-not-cr-lf
This HTTP header-value screen rejects NUL bytes but accepts bare CR or LF bytes in $DATA. A parser that splits header lines only on CRLF keeps a bare CR/LF inside the value, while lenient front-end proxies treat that byte as a line terminator; the framing disagreement lets a hidden header such as Content-Length stay folded into the value and smuggle or re-fr
