libsoup accepts duplicate Host: headers and implements a last-value-wins policy when soup_message_headers_get_one[_common] is used to construct the request URI, while many proxies and routers use the first Host: header for routing. The provided PoC reliably demonstrates that a proxy honoring the first Host: can route to backend A but the libsoup server will interpret the request as for host B (last header), enabling virtual-host confusion and potential bypasses of host-based ACLs or cache poisoning.