Duplicate Content-Length: BodyFramingDetector and ContentLengthBodyReader disagree (last-wins vs first-wins) #67

Severity: Medium — 2026-10-30 security review

BodyFramingDetector (src/Glyph11/Validation/BodyFramingDetector.cs:39-42) keeps the last Content-Length header's value; ContentLengthBodyReader.ParseContentLength (src/Glyph11/Validation/ContentLengthBodyReader.cs:24-58) returns the first.

Reachable via Pico (which doesn't reject conflicting CLs): one layer frames by 10, the other by 5 — textbook CL-smuggling.

Fix: the UltraHardened parser rejects conflicting CLs; these helpers should too (or at least agree with each other).