A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Red Hat |
|
| Redhat |
|
No data.
No data.
References
History
Thu, 15 Oct 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:debezium:3.6 | |
| References |
|
Fri, 09 Oct 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat apache Camel Quarkus
Redhat quarkus |
|
| CPEs | cpe:/a:redhat:apache_camel_quarkus:3.33 cpe:/a:redhat:quarkus:3.27::el8 cpe:/a:redhat:quarkus:3.33::el8 |
|
| Vendors & Products |
Redhat apache Camel Quarkus
Redhat quarkus |
Tue, 22 Sep 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 21 Sep 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 21 Sep 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
|
| Vendors & Products |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
Mon, 21 Sep 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | ||
| Vendors & Products |
Redhat quarkus
|
|
| References |
|
Sat, 19 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems. |
Fri, 18 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R | |
| Title | Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte | |
| First Time appeared |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-1035 | |
| CPEs | cpe:/a:redhat:amq_broker:7 cpe:/a:redhat:amq_clients:2023 cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2026-09-18T14:18:11.431Z
Updated: 2026-10-15T16:42:40.628Z
Reserved: 2026-09-18T09:59:50.676Z
Link: CVE-2026-93565
Vulnrichment
Updated: 2026-09-21T19:48:35.657Z
NVD
Status : Awaiting Analysis
Published: 2026-09-18T15:17:20.093
Modified: 2026-10-15T17:17:30.943
Link: CVE-2026-93565
Redhat