Improper validation of the final transfer coding in the `Transfer-Encoding` header allows attackers to perform request smuggling using malformed encoding declarations. This occurs when attackers split the `Transfer-Encoding` header across multiple lines or use values such as `chunked, xchunked` to bypass validation. Consequently, messages may be decoded as chunked even when the final coding is not chunked.