There is a bug in line 150 of hudson.remoting.Engine which reads:

String[] tokens = tunnel.split(":");
if(tokens.length!=2)
throw new IOException("Illegal tunneling parameter: "+tunnel);

This does not work as documented since String.split ignores delimiters at the
end of the string, thus when tunnel="HOST:" tokens.length is 1. The fix is trivial

String[] tokens = tunnel.split(":",2);
if(tokens.length!=2)
throw new IOException("Illegal tunneling parameter: "+tunnel);