Yep, you can generally get request splitting style vulnerabilities especially as a reverse proxy if you misparse reqs. (And sometimes even if you don't, one rea

Yep, you can generally get request splitting style vulnerabilities especially as a reverse proxy if you misparse reqs. (And sometimes even if you don't, one reason a rev proxy architecture is somewhat insecure). Hopefully the actual code does a full parse after guessing what to try by the character test heuristic.