I'm not the OP but that sounds like http desync bugs like https://portswigger.net/research/http-desync-attacks-request...