Impact

Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.

Patches

#1547

Workarounds

None except migrating to a better proxy.

References

https://portswigger.net/web-security/request-smuggling
https://tools.ietf.org/html/rfc7230#section-9.5