CVE-2026-93565

Overview

CVE-2026-93565 allows an attacker to send RTSP requests with trailing control bytes that are silently stripped by RtspMethods.valueOf(), causing the server to treat them as valid method tokens. This flaw exists in Netty-based RTSP servers and can lead to unauthorized or malformed requests being accepted as legitimate. The vulnerability is critical with a CVSS v3 score of 9.8.

Description

### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R

Impact

The flaw compromises the integrity of RTSP request handling, allowing attackers to bypass method validation and potentially execute unintended actions. Confidentiality is at risk if sensitive media streams are accessed, availability can be impacted by malformed requests, and integrity of control commands is undermined. Defenders must protect against unauthorized RTSP traffic and ensure proper method validation.

Remediation

Upgrade Netty to the latest version that includes the hardened RtspMethods.valueOf() implementation. If an upgrade is not immediately possible, apply a custom patch or configuration to reject RTSP requests containing trailing control characters. Additionally, enable strict request validation in the application layer and monitor for anomalous RTSP traffic.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.8, indicating a high likelihood of exploitation and severe impact. No EPSS data is available, but the lack of mitigation in current Netty releases warrants prompt action.

Affected products

• Netty RTSP server
• Java RTSP server
• RTSP server using Netty
• rtsp-server-java
• rtsp-server-netty
• rtsp-server