CRLF Injection in HTTP header values allows arbitrary header injection

curl allows carriage return `(\r)` and line feed `(\n)` characters inside HTTP header **values**. When attacker-controlled data is used in a header value (e.g., `Authorization: Bearer <token>`), curl construct and sends a malformed HTTP request containing injected headers.

from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
    def do_POST(self):
        is_admin = self.headers.get("X-Admin") == "1"
        length = int(self.headers.get("Content-Length","0"))
        self.rfile.read(length)
        if self.path == "/delete" and …