CVE-2026-93561: Netty Memcache Codec Information Disclosure

CVE-2026-93561 Overview

CVE-2026-93561 affects the io.netty/netty-codec-memcache component. The Memcache binary protocol codec reads keyLength and extrasLength fields as signed Java integers rather than unsigned values as required by the protocol specification. A malicious Memcache server can send a crafted response that triggers frame desynchronization in the codec. This desynchronization enables response smuggling, where one client's data leaks into another client's response stream in proxy or cache deployments. The flaw is categorized under [CWE-1035] and can be exploited over the network without authentication or user interaction.

Critical Impact
Attackers controlling a Memcache server can cause cross-client response smuggling in shared proxy and cache environments, exposing data between concurrent client sessions.

Affected Products

io.netty:netty-codec-memcache (Memcache binary protocol codec)
Applications embedding the Netty Memcache codec in proxy or cache tiers
Downstream distributions tracked in the Red Hat CVE-2026-93561 Advisory

Discovery Timeline

2026-09-18 - CVE-2026-93561 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-93561

Vulnerability Analysis

The Memcache binary protocol defines keyLength as a 16-bit unsigned integer and extrasLength as an 8-bit unsigned integer inside the response header. The Netty codec reads these fields into signed Java primitive types. When a Memcache server returns a response with the high bit set on either field, the codec interprets the value as negative or as a mismatched positive integer.

This mismatch causes the codec to consume the wrong number of bytes from the inbound buffer. Subsequent frames are parsed starting at an incorrect offset, breaking the one-to-one mapping between client requests and server responses. In multi-tenant proxy or cache environments that multiplex clients over shared upstream connections, the desynchronized stream returns one client's cached data inside another client's response. The confidentiality and integrity impact is limited to data flowing through the affected pipeline.

Root Cause

The root cause is a type handling defect [CWE-1035]. Java lacks native unsigned primitive types, and the codec did not apply masking such as & 0xFF or & 0xFFFF when reading extrasLength and keyLength. Values above 0x7F and 0x7FFF are therefore parsed with incorrect sign extension, producing invalid frame boundaries.

Attack Vector

Exploitation requires an attacker-controlled Memcache server or an attacker able to inject responses into a Memcache connection consumed by a Netty-based client. The attacker crafts a binary response with keyLength or extrasLength values that trigger the signed interpretation bug. Downstream clients sharing the pipeline then receive smuggled response data. No authentication or user interaction is required against the vulnerable client. See the Red Hat Bug Report #2536949 for technical details.

Detection Methods for CVE-2026-93561

Indicators of Compromise

Memcache binary responses where extrasLength exceeds 0x7F or keyLength exceeds 0x7FFF on the wire.
Client logs showing responses whose keys or opaque identifiers do not match any recently issued request.
Cache hit ratios and response payloads that diverge unexpectedly between clients sharing an upstream Memcache pool.

Detection Strategies

Inventory Java applications and container images for vulnerable versions of io.netty:netty-codec-memcache using software composition analysis.
Inspect network captures of Memcache binary traffic for header fields with the high bit set in keyLength or extrasLength.
Enable strict opaque-token validation in Memcache client code paths to detect request-to-response mismatches indicative of smuggling.

Monitoring Recommendations

Alert on Netty channel exceptions and decoder errors originating from MemcacheDecoder classes.
Monitor proxy and cache tiers for anomalous response-to-request ratios or unexpected payload sizes.
Correlate application error logs with upstream Memcache server changes or newly introduced Memcache endpoints.

How to Mitigate CVE-2026-93561

Immediate Actions Required

Identify all deployments using io.netty:netty-codec-memcache and prioritize those exposing shared proxy or cache pipelines.
Restrict Memcache client connections to trusted, authenticated servers on isolated network segments.
Apply vendor updates as they become available from Netty maintainers and downstream distributors.

Patch Information

Refer to the Red Hat CVE-2026-93561 Advisory for fixed package versions and downstream availability. Track upstream Netty releases for the corrected codec that reads keyLength and extrasLength as unsigned values.

Workarounds

Terminate Memcache connections only against servers under direct administrative control until patches are deployed.
Disable request pipelining and multiplexing across tenants in Memcache client configurations to limit smuggling exposure.
Place a validating proxy in front of Memcache servers that rejects binary responses with malformed length fields.

bash

# Example: pin a fixed Netty version in a Maven project once available
# Replace <FIXED_VERSION> with the patched release from the vendor advisory
mvn versions:set-property \
  -Dproperty=netty.version \
  -DnewVersion=<FIXED_VERSION>