Appscan injected the following into a test request GET /bank/customize.aspx?lang=Foobar%3f%0d%0aAppScanHeader:%20AppScanValue%2f1%2e2%2d3%0d%0aSecondAppScanHeader:%20whatever HTTP/1.0. What kind of vulnerability is appscan testing for?

The injected payload contains %0d%0a (CRLF - carriage return + line feed) used to split HTTP responses. AppScan tests for HTTP Response Splitting by injecting these characters to attempt injecting arbitrary headers or splitting the response body. This can lead to cache poisoning, XSS, or other attacks. CRLF injection is the key indicator.