Kestrel HTTP/1.x is strict about spec new line (CRLF) parsing restrictions. However it does not consistently enforce the same restrictions when decoding HTTP/2 (and HTTP/3) headers. IIS HTTP/2 rejects control characters (except for tab) and kestrel should do the same.

https://datatracker.ietf.org/doc/html/rfc7230#section-3.2
https://datatracker.ietf.org/doc/html/rfc7540#section-10.3