Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-18 | 1 | Disclosure1 |
| 2026-09-20 | 1 | Disclosure1 |
| 2026-09-22 | 1 | Patch1 |
CVE-2026-93565 ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) befor… https://www.cve.org/CVERecord?id=CVE-2026-93565
Post summary
The text discloses technical details of CVE-2026-93565, describing how RtspMethods.valueOf() strips trailing control bytes, and links to the official CVE record.
HttpMethod got the harden pass. RtspMethods didn't. CVE-2026-93565 lets PLAY\x00 look like a clean PLAY through Netty's RTSP decoder (7.5). Keycloak, Camel, or AMQ with netty-codec-http under 4.1.138 / 4.2.18 is the problem. I'd bump the jar before I touch ACLs.
Post summary
The text identifies CVE-2026-93565 in Netty's RTSP decoder (CVSS 7.5) and advises patching by updating to versions 4.1.138 or 4.2.18+ to mitigate the vulnerability.
🚨 HIGH Severity: CVE-2026-93565 (CVSS 7.5) Netty RTSP method parsing flaw allows bypass via trailing control bytes. RtspMethods.valueOf() silently strips control chars, enabling request smuggling. Impact: Integrity compromise #CVE #Vulnerability #PatchNow https://t.co/fmX5Cumt2l
Post summary
The text discloses CVE-2026-93565, a high-severity parsing flaw in Netty RTSP, with technical details and a CVSS score but does not mention remediation, PoC, or active exploitation.