A vulnerability in Netty's HTTP/3 codec (netty-codec-http3) allows an attacker to cause unbounded memory allocation during QPACK header decoding. Specifically, the decoder may allocate a large byte array based on a length value from the wire without verifying that the data is actually present, enabling a denial-of-service condition due to excessive memory consumption.