CVE-2022-32213: llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

The vulnerability stems from improper Transfer-Encoding header validation. The commit diff shows a critical change in src/http.c where the llhttp__after_headers_complete function was modified to include a check for LENIENT_TRANSFER_ENCODING. Prior to this fix, the parser would erroneously accept multiple Transfer-Encoding values (like 'chunked, gzip') without proper validation, violating RFC 7230 requirements. This flaw allowed attackers to craft requests that bypass security checks, leading to request smuggling. The function's pre-patch logic failed to enforce strict parsing when leniency wasn't explicitly enabled, making it the root cause.