Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions from 4.2.0.Final through 4.2.17.Final retain unbounded per-stream QPACK encoder state, which can cause unbounded heap growth and potential denial of service. The vulnerability is fixed in version 4.2.18.Final.