CVE-2026-93565

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description An issue exists in the RtspDecoder where the RtspMethods.valueOf() function incorrectly strips trailing control bytes (characters with code points <= 0x20) from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request to perform method-token smuggling. This allows the attacker to bypass method-based access controls or launder malicious requests through Netty-based RTSP proxies, causing them to appear legitimate to backend systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.