CVE-2026-93565

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-93565
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2026:69440
https://access.redhat.com/errata/RHSA-2026:69470
https://access.redhat.com/errata/RHSA-2026:70257
https://access.redhat.com/errata/RHSA-2026:83612
https://access.redhat.com/security/cve/CVE-2026-93565
https://bugzilla.redhat.com/show_bug.cgi?id=2536952
Configurations

No configuration.

History

15 Oct 2026, 17:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:83612 -

22 Sep 2026, 17:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:69440 -
  • () https://access.redhat.com/errata/RHSA-2026:70257 -

21 Sep 2026, 17:19

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:69470 -

18 Sep 2026, 21:18

Type Values Removed Values Added
Summary (en) ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R (en) A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

18 Sep 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-18 15:17

Updated : 2026-10-15 17:17

NVD link : CVE-2026-93565

Mitre link : CVE-2026-93565

CVE.ORG link : CVE-2026-93565

JSON object : View

Products Affected

No product.

CWE
CWE-1035

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities