getallmatchinheaders() is not documented, i.e. it's not part of the public API. Furthermore, it's only used by http.server.CGIHTTPRequestHandler, and the comment above it even says that it should be moved there.

There are three options now:
1) Document the function to make it officially part of the public API
2) Rename and move the function to http.server
3) Leave it undocumented and just fix it

In any case, the first thing that should be done is to add a test for CGIHTTPRequestHandler that fails with the current (broken) getallmatchinheaders() implementation.