ZeroDay Findings
Sign inSign up

Findings

CVE-2026-93565

A flaw was found in Netty RtspDecoder.

Published Sep 18, 2026 · updated Oct 15, 2026

A flaw was found in Netty RtspDecoder. The function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 18, 2026 · NIST NVD

    Detected

    A flaw was found in Netty RtspDecoder. The function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requ

  2. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in Netty RtspDecoder. The function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requ

Sources

  • CVE.orgVulnerability recordCVE-2026-93565

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-93565

    A flaw was found in Netty RtspDecoder. The function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to met

    nvd.nist.gov

References

CVE-2026-93565 · ZeroDay Findings