Summary

When a user set http header value containing CR/LF, the http response is split.
https://www.owasp.org/index.php/HTTP_Response_Splitting

Of course, users should validate the value to avoid this kind of problems.
However, it's worth to provide measures from framework for careless users.

I think HttpFirewall is suitable place to remove CR/LF in header.

Actual Behavior

HttpHeaders headers = new HttpHeaders();
headers.add("abc", "abc¥r¥nContent-Length:100¥r¥n¥r¥n ...");

abc: abc
Content-Length: 100

HttpHeaders headers = new HttpHeaders();
headers.add("abc", "abc¥r¥nContent-Length:100¥r¥n¥r¥n ...");

abc: abc Content-Length: 100 ...