A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat AMQ Broker 7 | affected | — |
| Red Hat | Red Hat AMQ Clients | affected | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | affected | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | affected | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | affected | — |
| Red Hat | Red Hat build of Debezium 3 | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Data Grid 8 | affected | — |
| Red Hat | Red Hat Fuse 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | affected | — |
| Red Hat | Red Hat Single Sign-On 7 | affected | — |
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Red Hat
Subscribe
|
Red Hat Amq Broker 7
Subscribe
|
|
Redhat
Subscribe
|
Amq Clients
Subscribe
Build Of Apache Camel For Quarkus
Subscribe
Build Of Apache Camel For Spring Boot
Subscribe
Build Of Apicurio Registry
Subscribe
Build Of Debezium 3
Subscribe
Build Of Keycloak
Subscribe
Build Of Quarkus
Subscribe
Data Grid 8
Subscribe
Jboss Enterprise Application Platform
Subscribe
Quay 3
Subscribe
Single Sign-on
Subscribe
|
Project Subscriptions
| Vendors | Products |
|---|---|
|
Red Hat
Subscribe
|
Red Hat Amq Broker 7
Subscribe
|
|
Redhat
Subscribe
|
Amq Broker
Subscribe
Amq Clients
Subscribe
Apicurio Registry
Subscribe
Build Keycloak
Subscribe
Build Of Apache Camel For Quarkus
Subscribe
Build Of Apache Camel For Spring Boot
Subscribe
Build Of Apicurio Registry
Subscribe
Build Of Debezium 3
Subscribe
Build Of Keycloak
Subscribe
Build Of Quarkus
Subscribe
Camel Quarkus
Subscribe
Camel Spring Boot
Subscribe
Data Grid 8
Subscribe
Debezium
Subscribe
Jboss Data Grid
Subscribe
Jboss Enterprise Application Platform
Subscribe
Jboss Fuse
Subscribe
Quay 3
Subscribe
Red Hat Single Sign On
Subscribe
Single Sign-on
Subscribe
|
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.
References
History
Mon, 21 Sep 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 21 Sep 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
|
| Vendors & Products |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
Mon, 21 Sep 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | ||
| Vendors & Products |
Redhat quarkus
|
|
| References |
|
Sat, 19 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems. |
Fri, 18 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R | |
| Title | Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte | |
| First Time appeared |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-1035 | |
| CPEs | cpe:/a:redhat:amq_broker:7 cpe:/a:redhat:amq_clients:2023 cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-21T20:51:46.984Z
Reserved: 2026-09-18T09:59:50.676Z
Link: CVE-2026-93565
Vulnrichment
Updated: 2026-09-21T19:48:35.657Z
NVD
Status : Awaiting Analysis
Published: 2026-09-18T15:17:20.093
Modified: 2026-09-21T21:17:18.260
Link: CVE-2026-93565
Redhat
OpenCVE Enrichment
Updated: 2026-09-21T19:25:33Z
Weaknesses