Security-header bypass via oversized backend response header

HTTP response splitting in mod_proxy before 2.4.55 allows a malicious backend to prevent clients from interpreting later security headers. The ap_proxy_read_headers routine accepts an overlong backend header after ap_proxygetline returns ENOSPC, retaining the truncated header and treating later header bytes as response body. Exploitation requires a proxied response from a malicious or compromised backend, and the bounded impact is loss of protections supplied by headers placed after the oversized field.