Netty's HTTP/3 codec builds the :authority pseudo-header from the HTTP/1 Host header before honoring the authority value in an absolute-form HTTP request-target, violating RFC 9110. This allows a remote client to supply a Host header that differs from the request-target authority. The resulting authority confusion can mislead routing, caching, and authorization logic, enabling violations of virtual-host isolation, allow-list checks, or backend selection. The weakness is an input validation problem (CWE-20) and the improper construction of the pseudo-header (CWE-444), and results only in integrity impact; it does not enable code execution or crash the server.

The flaw affects Netty and its HTTP/3 codec module (io.netty:netty-codec-http3) across versions 4.2.2.Final through 4.2.17.Final. It is fixed in 4.2.18.Final and later releases.

With a CVSS score of 8.7, the vulnerability is considered high severity. No EPSS data is available, so the current exploitation probability is unknown, but the flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a crafted HTTP/1 request to a Netty-based gateway, proxy, or protocol bridge that forwards traffic to an HTTP/3 backend. Successful exploitation could lead to misrouting or unauthorized access to protected resources, depending on how the application uses the :authority header.