Netty RtspDecoder Method-Token Smuggling via RTSP Request
CVE-2026-93565 Published on September 18, 2026

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-93565 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public.

Weakness Type

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.


Products Associated with CVE-2026-93565

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-93565 are published in these products:

Red Hat Amq Broker
 
Red Hat Amq Clients
 
Red Hat Camel Quarkus
 
Red Hat Camel Spring Boot
 
Red Hat Apicurio Registry
 
Red Hat Debezium
 
Red Hat Build Keycloak
 
Red Hat Quarkus
 
Red Hat Jboss Data Grid
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Single Sign On
 
Red Hat Apache Camel Quarkus
 
Oracle
 

Affected Versions

Red Hat Build of Apache Camel 3.33.3.SP2: Red Hat Build of Debezium 3.6: Red Hat build of Quarkus 3.27.5.SP2: Red Hat build of Quarkus 3.33.3.SP2: Red Hat AMQ Broker 7: Red Hat AMQ Clients: Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apache Camel for Spring Boot 4: Red Hat build of Apicurio Registry 3: Red Hat Build of Keycloak: Red Hat Data Grid 8: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat Single Sign-On 7: