That is unusual. Could you please execute the following cURL command on your terminal to help clarify the situation?
curl --location --request DELETE 'https://api-hft.upstox.com/v2/order/cancel?order_id={your_order_number}' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer {your_access_token}'
This should give us a better understanding. Thank you!