The vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final arises because the HTTP/3 :authority pseudo-header is constructed from the HTTP/1 Host header before considering the authority component of an absolute-form HTTP/1 request-target. According to HTTP/1.1 specifications, when an absolute-form request-target is received, the Host header should be ignored for authority determination. However, Netty's implementation gives precedence to a non-empty Host header, leading to authority confusion. In scenarios such as HTTP/1-to-HTTP/3 gateways or proxies, a remote client can send conflicting authority information (e.g., a request-target with a trusted domain but a Host header with an attacker-controlled domain). This discrepancy can cause components that rely on the authority for routing, authorization, or caching to make inconsistent decisions compared to the upstream HTTP/3 peer. The impact is limited to integrity issues without code execution or availability effects. The issue is resolved in Netty version 4.2.18.Final.

The vulnerability causes authority confusion between HTTP/1 and HTTP/3 layers in Netty-based gateways or proxies, potentially leading to incorrect virtual-host routing, allow-list checks, backend selection, cache key generation, and URL generation. This can result in integrity violations where requests are misrouted or unauthorized access decisions are made based on conflicting authority information. There is no impact on code execution, memory corruption, or service availability.

Upgrade Netty's HTTP/3 codec to version 4.2.18.Final or later where this issue is fixed. No other mitigation is required as the fix addresses the root cause by correctly prioritizing the authority from the absolute-form request-target over the Host header.