In PHP prior to 8.1.32, 8.2.28, 8.3.19, and 8.4.5, Streams HTTP wrapper does not fail for headers with invalid name and no colon. This can allow issues in the application when parsing the array - e.g. application could consider it as a valid header or as a continuation of the previous one (currently folding header are misbehaving so there could be some logic for that in the application that could result in a security issue). So some sort of request smuggling could be possible in this case