Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a vulnerability in the QPACK encoder-stream instruction decoder that allows an attacker to cause uncontrolled resource consumption. This can lead to unbounded heap growth and an OutOfMemoryError, resulting in denial of service. The issue is fixed in version 4.2.18.Final.