Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly prioritize the HTTP/1 Host header over the authority in an absolute-form HTTP/1 request-target when building the HTTP/3 :authority pseudo-header. This violates HTTP/1.1 rules and can cause authority confusion in HTTP/1-to-HTTP/3 gateways or proxies, potentially leading to incorrect virtual-host routing, allow-list checks, backend selection, cache key usage, and URL generation. The vulnerability impacts data integrity but does not affect code execution or availability. The issue is fixed in version 4.2.18.Final.