“As a final blow, there’s no way to disable this behavior, even though people have complained about this behavior leading to security vulnerabilities since at least 2016.”
Go’s JSON parser matches keys case-insensitively and takes the last duplicate. Almost no other parser does that, so a Go proxy and a non-Go backend read the same request differently. The Kelvin sign even matches the letter k. People have flagged this as a security problem since 2016, and there is still no switch to turn it off.