Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder. The decoder does not limit the number of continuation bytes it processes, allowing a remote unauthenticated attacker to cause unbounded memory growth and CPU exhaustion. This results in OutOfMemoryError and event-loop CPU starvation. The issue is fixed in version 4.2.18.Final.