CVE-2026-93561

Name of the Vulnerable Software and Affected Versions io.netty/netty-codec-memcache (affected versions not specified)

Description The Memcache binary protocol codec incorrectly processes keyLength and extrasLength as signed Java types instead of unsigned types. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response, leading to frame desynchronization and response smuggling. In proxy or cache environments, this may result in one client's data being inadvertently exposed to another client's response stream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.