Netty vulnerable to HTTP Response splitting from assigning header value iterator
### Impact
When calling `DefaultHttpHeaders.set` with an _iterator_ of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting
https://owasp.org/www-community/attacks/HTTP_Response_Splitting.
### Patches
The necessary validation was added in Netty 4.1.86.Final.
### Workarounds
Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
### References
HTTP Response Splitting
https://owasp.org/www-community/attacks/HTTP_Response_Splitting
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
https://cwe.mitre.org/data/definitions/113.html
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo
https://github.com/netty/netty](https://github.com/netty/netty)
* Email us at [netty-security@googlegroups.com](mailto:netty-security@googlegroups.com)