Host header validation is weak: empty value and printable junk pass #68

Severity: Medium — 2026-10-30 security review

Exactly one Host header is required, but an empty value passes and the only content check is "no @, no /" (src/Glyph11/Parser/UltraHardened/UltraHardenedParser.FullHeader.ROM.cs:273-279, core/src/glyph11.c:550-553) — Host: a b or arbitrary printable junk is accepted.

Impact: anything routing or authorizing on Host must not treat this as validation.

Fix: an explicit host-grammar check (reg-name / IPv4 / IPv6-literal, optional :port, empty rejected) would match the "hardened" claim.