function’s format string may result in a buffer overflow.
HTTP Response Splitting. Writing unvalidated data into
an HTTP header allows an attacker to specify the entirety
of the HTTP response rendered by the browser.