Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
I think the real problem here is that people are writing web servers that don't enforce spec.As soon as a space in a header name is found, a 400 Bad Request needs to be thrown.  "Content-Length abcd: 0" is invalid and should never be accepted.