The HTTP/3 codec in Netty 4.2.0 through 4.2.17 does not enforce that the :authority pseudo‑header and the host header contain the same value. A remote attacker can send a single HEADERS frame with conflicting values; the request is accepted and forwarded to the application with two different authorities. This allows the attacker to trick routing logic, virtual‑host resolution, and access‑control decisions in components that use different header fields, effectively bypassing restrictions and gaining unauthorized access.

Netty projects that include the HTTP/3 codec module (io.netty:netty-codec-http3), using any version from 4.2.0.Final through 4.2.17.Final. The issue is fixed in 4.2.18.Final, so any deployment relying on the vulnerable range is impacted.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower but non‑negligible exploitation probability. The most likely attack path is a remote, unauthenticated client over a QUIC/HTTP‑3 connection that supplies malformed header fields. Because the bug resides in a fundamental protocol parsing component, exploitation is straightforward for an attacker who can establish a QUIC session to the server.