Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets during conversion to HTTP/3. This flaw allows an attacker to control the tunnel :authority in HTTP/3 CONNECT requests, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is resolved in version 4.2.18.Final.