CVE-2026-93565 Overview
CVE-2026-93565 is a method-token smuggling flaw in the Netty RtspDecoder component. The RtspMethods.valueOf() function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can send a specially crafted RTSP request to bypass method-based access controls. The flaw also enables attackers to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems. The weakness is categorized as [CWE-1035], relating to trust boundary violations in protocol parsing.
Critical Impact
Remote attackers can bypass RTSP method-based access controls and smuggle malicious requests through Netty-based proxies without authentication or user interaction.
Affected Products
- Netty framework RtspDecoder component
- Red Hat products distributing vulnerable Netty (see RHSA-2026:69440, RHSA-2026:69470, RHSA-2026:70257)
- Applications and proxies embedding Netty for RTSP handling
Discovery Timeline
- 2026-09-18 - CVE-2026-93565 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93565
Vulnerability Analysis
The vulnerability resides in Netty's RTSP protocol handling code. When the RtspDecoder processes an incoming request line, it calls RtspMethods.valueOf() to resolve the method token (for example DESCRIBE, SETUP, PLAY). The resolver strips trailing control bytes from the token before comparing it against known method names. This normalization means that two byte sequences that differ in trailing control characters can resolve to the same method internally, while appearing distinct to upstream security controls or downstream backends.
The result is a parser desynchronization between Netty and any adjacent component that inspects the raw request bytes. Access control filters that block specific methods can be evaded by appending control bytes to the method token. When Netty operates as an RTSP proxy, the request forwarded to the backend can differ from what perimeter defenses inspected, enabling request smuggling.
Root Cause
The root cause is improper input normalization in RtspMethods.valueOf(). The function silently discards trailing control bytes rather than rejecting the malformed token. RTSP method tokens are defined as strict ASCII strings, so any byte outside the allowed set should cause the decoder to reject the request. Lenient parsing violates the trust boundary between the decoder and downstream consumers.
Attack Vector
Exploitation requires only network access to a service that uses Netty's RtspDecoder. No authentication, privileges, or user interaction are needed. An attacker crafts an RTSP request where the method token is followed by one or more control bytes before the space and URI. Perimeter filters see an unknown or blocked method, while Netty resolves the token to a valid RTSP verb. In proxy scenarios, the attacker can pair this with a second, differently framed request to smuggle intent past inspection. See the Red Hat CVE Analysis for CVE-2026-93565 and Red Hat Bug Report #2536952 for protocol-level details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93565
Indicators of Compromise
- RTSP request lines containing non-printable or control bytes between the method token and the space delimiter.
- Discrepancies between method tokens logged at a perimeter proxy and the method dispatched by a Netty-based backend.
- Unexpected successful RTSP method invocations against endpoints that should reject them via access-control rules.
Detection Strategies
- Inspect RTSP traffic for method tokens that contain bytes outside the ASCII letter range and alert on any occurrence.
- Correlate access logs between front-end filters and Netty backends to surface method mismatches indicative of smuggling.
- Deploy protocol-aware network monitoring that reconstructs RTSP request lines and flags non-conformant framing.
Monitoring Recommendations
- Enable verbose request logging at RTSP ingress points including raw method byte sequences for forensic review.
- Track anomalous spikes in RTSP requests targeting privileged methods such as SETUP, RECORD, or TEARDOWN.
- Feed RTSP telemetry into an XDR or SIEM pipeline to correlate method-token anomalies with downstream authorization events.
How to Mitigate CVE-2026-93565
Immediate Actions Required
- Inventory all applications, proxies, and media services that embed the Netty framework and expose RTSP endpoints.
- Apply the patched Netty release referenced in the vendor advisories as soon as it is validated in a staging environment.
- Restrict RTSP endpoint exposure to trusted networks until patching is complete.
Patch Information
Red Hat has issued fixes through RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257. Administrators should update to the Netty version shipped in these errata or the upstream fixed release. Verify that all transitive dependencies pulling Netty into application classpaths are also upgraded.
Workarounds
- Place a strict RTSP-aware reverse proxy in front of Netty services and reject any request line containing control bytes.
- Disable RTSP handling entirely on services that do not require it by removing the RtspDecoder from the pipeline.
- Enforce network-level access controls to limit RTSP exposure to authenticated clients and known source ranges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
