How to: HTTP Header Injection
https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning
# HTTP header injection is often under-estimated and misclassified as a moderate severity flaw equivalent to XSS or worse, Open Redirection. In this post, I'll share a simple technique I used to take a header injection vulnerability, make it critical, and earn a $12,500 bounty.
# This technique applies to both request header injection on front-end servers, and response header injection on back-end servers.

https://lab.ctbb.show/research/crlf-injection-nested-response-splitting-csp-gadget
# CRLF Injection Nested Response Splitting CSP Gadget.