CVE-2026-39805: Elixir Bandit Duplicate Header Smugglingcve-2026-39805-elixir-bandit-duplicate-header-smuggling
Extracting HTTP request headers such as 'content-length' using a function that only returns the first occurrence (like `List.keyfind`) ignores duplicates. This violates RFC 9112 §6.3 and can permit HTTP Request Smuggling. Instead of fetching the first match, filter all matching headers and reject the request if duplicates or conflicts are found.
