Web application firewalls and origin servers don’t always parse a request the same way. When the CDN normalises a header one way and the origin another, a payload the WAF considered safe can reach the app intact.
The mismatch
Describe the specific parsing quirk you abused — header folding, duplicate parameters, or content-type confusion — and how you confirmed the two systems disagreed.
Impact & fix
Explain the impact and the mitigation: normalise before inspection, and reject ambiguous requests outright.