CVE-2026-93565

Executive Summary

CVE-2026-93565 is an input-validation weakness in Netty's RTSP codec (RtspMethods.valueOf()) whereby trailing control bytes (any character with a code point ≤ 0x20) are silently stripped before a cache lookup against the ten pre-populated RTSP method constants. An attacker can send a wire-delivered RTSP request whose method token ends with a trailing control byte — for example PLAY\x00 or PLAY\r immediately before the separating space — that the RtspDecoder treats as a fully successful, clean request (decoderResult().isSuccess() == true, request.method() == RtspMethods.PLAY). Impact is rated 7.5 (High) on CVSS 3.1 with integrity:High, because the application layer cannot distinguish the malformed method token from a legitimate PLAY request, enabling protocol-level parsing inconsistency between security filters and the application. The vulnerability is UNPATCHED per all tracked sources, with no public PoC, no Nuclei template, and no CISA KEV listing as of this report.

Technical Analysis

Netty is a widely deployed asynchronous network application framework; its RTSP codec (codec-rtsp) is used to parse Real Time Streaming Protocol requests in media servers, surveillance/NVR gateways, streaming proxies, and IoT video devices built on Netty.

The specific flaw resides in RtspMethods.valueOf(). Per the NVD description, this method "silently strips trailing control bytes (any character with code point <= 0x20, the full range that String.trim() removes) before performing a cache lookup against its ten pre-populated method constants." The ten RTSP method constants are the cached singletons validated through this lookup. Because the trim occurs before the cache lookup, an input such as PLAY\x00 or PLAY\r is normalized to PLAY and resolved to the exact same cached singleton object reference as a legitimate PLAY request.

The NVD description further states this is "the same root cause as #16723 and #16971, in a sibling that those fixes did not reach." The remediation applied to HttpMethod hardened HttpMethod.valueOf() directly. However, RtspMethods.valueOf() contains "its own independent checkNonEmptyAfterTrim() call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened HttpMethod constructor ever sees it." This is a classic case of parallel code paths where a fix was applied to one sibling class but not its RTSP analog, leaving the RTSP method parser wedged between the trim logic and the hardened constructor.

The security consequence is an integrity/parsing differential: at the wire level the method token is not a pure PLAY, but the decoder reports decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY (same object reference as the cached singleton). The application layer "cannot distinguish this from a clean PLAY request." This creates a desynchronization between any upstream inspection logic that operates on raw bytes (an IDS, WAF, reverse proxy, or API gateway expecting strict RFC compliance) and the Netty-based application that accepts the normalized form. Such differentials are the canonical precondition for request-smuggling-style, filter-bypass, or access-control-consistency attacks where a security control parses the method differently than the origin server.

The CWE assigned is CWE-1035 ("OWASP Top Ten 2017 Category A9 — Using Components with Known Vulnerabilities"), reflecting that the weakness manifests through a component dependency rather than a bespoke flaw. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms: network-reachable, low complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, High integrity impact, no availability impact.

Root-cause mapping (as stated in the description, no fabrication beyond it):

• The vulnerable operation is the pre-lookup trim in RtspMethods.valueOf().
• The mitigation gap is the independent checkNonEmptyAfterTrim() call in the RTSP path, versus the hardened HttpMethod constructor in the HTTP sibling.
• The observable outcome is a decoder success with a cached singleton RtspMethods.PLAY reference despite a non-conformant wire token.

No function names, endpoints, file paths, or parameters beyond those appearing verbatim in the NVD description are asserted. Detail on the exact RtspDecoder state machine beyond the successful-parse outcome and the class names cited is not available from the supplied data.

Exploitation Scenarios

The following chain is inferred strictly from the vulnerability class (trailing-control-byte normalization bypass) and the parser behavior explicitly documented in the NVD description. No public PoC is available. Steps describe the mechanism at the vulnerability-class level; no additional implementation specifics are invented.

1. Reconnaissance / target identification An adversary identifies a network-reachable service exposing an RTSP interface that is implemented on top of Netty's codec-rtsp. RTSP services commonly listen on TCP port 554. Because Netty is used broadly across media servers, streaming proxies, NVR/IPTV gateways, and embedded IoT video appliances, target identification proceeds through network scanning for RTSP banners and behavioral probing of RTSP method handling. The attacker needs no credentials or user interaction (PR:N, UI:N).

2. How the specific flaw class is triggered The flaw is triggered by sending a raw RTSP request whose method token ends with a trailing control byte (code point ≤ 0x20) immediately before the separating space — e.g., PLAY\x00 or PLAY\r . When RtspDecoder processes this, the underlying RtspMethods.valueOf() strips the trailing control byte and resolves the token to the cached RtspMethods.PLAY singleton. The decoder reports a successful parse (decoderResult().isSuccess() == true) and request.method() == RtspMethods.PLAY.

3. Payload / execution method at the vulnerability-class level The payload class is a malformed-but-accepted ASCII RTSP method line terminated with a control byte. Because the application-level object reference is identical to the legitimate singleton, the request is processed as a normal PLAY. Any inspection layer that strictly rejects control bytes in the method position will parse a different view of the same byte stream than the Netty-based origin, producing a parser-differential (a filter-bypass condition). Attackers chain this to defeat front-end request validation while the backend treats the request as fully valid.

4. Post-exploitation impact The documented CVSS impact is Integrity:High. The practical post-conditions, derived from the parser-differential class, include bypass of security controls that rely on strict method parsing, inconsistent authorization decisions between intermediaries and the origin, and the ability to smuggle or mutate method tokens through inspection points without the origin detecting a distinction. Because the description does not document state-changing side effects beyond a successful PLAY parse, downstream consequences specific to session hijacking, data exfiltration, or DoS are not asserted here. There is no documented evidence of exploit-in-the-wild and CVSS records no confidentiality or availability impact.

No public PoC, exploit code, or Nuclei template exists for CVE-2026-93565; the chain above is inferred from the vulnerability class only.

Impact Assessment

• CVSS Base Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (remote, no adjacency requirement)
• Attack Complexity: Low — a single malformed request reaches the parser; no race condition or special preconditions are documented
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: None
• Integrity: High — the parser accepts a non-conformant token as an exact singleton match, breaking the integrity contract between wire bytes and application view
• Availability: None

Business impact. Any organization operating Netty-based RTSP services — streaming platforms, video surveillance backends, IPTV/OTT infrastructure, and embedded IoT media devices — is potentially in scope. The parser-differential condition undermines trust in request-identity at the application boundary, which is a foundational control for authentication and authorization decisions. Because the malformed method is indistinguishable from a legitimate one at the application layer, downstream logging, auditing, and security analytics may record only a clean PLAY, degrading forensic visibility.

Blast radius. Netty is a shared dependency across a very large ecosystem; the blast radius at the framework level is broad, though impact at the product level depends on whether the affected product exposes an RTSP service and whether intermediary controls parse method tokens strictly. Because AFFECTED_VERSION is not enumerated by any tracked source, no precise product/version inventory can be stated.

Urgency qualifiers. CISA KEV: NO. EPSS: not yet scored by FIRST.org (no value is fabricated here). Exploit code: None. Nuclei template: None. Patch confidence 0/4 — UNPATCHED per all tracked sources.

Detection Guidance

Detection must account for the fact that Netty's own decoder will not flag the malformed request. Defense therefore relies on the network edge, raw-byte inspection, and telemetry that captures the original wire token before normalization.

Sigma Rule

title: Netty RTSP Method Token With Trailing Control Byte (CVE-2026-93565)
id: 4f0c2e7a-9b1d-4c6e-8a2f-93565cve2026
status: experimental
description: >
  Detects RTSP request lines whose method token is followed by a trailing control
  byte (code point <= 0x20) before the separating space, indicative of abuse of
  RtspMethods.valueOf() normalization in Netty (CVE-2026-93565).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93565
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: rtsp
detection:
  selection_method:
    - 'PLAY'
    - 'PAUSE'
    - 'RECORD'
    - 'SETUP'
    - 'TEARDOWN'
    - 'GET_PARAMETER'
    - 'SET_PARAMETER'
    - 'ANNOUNCE'
    - 'DESCRIBE'
    - 'OPTIONS'
  selection_control_byte:
    request|re: '^(PLAY|PAUSE|RECORD|SETUP|TEARDOWN|GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] '
  condition: selection_control_byte
falsepositives:
  - Legitimate clients that terminate method tokens with CR that are normalised upstream before logging
level: high
tags:
  - attack.t1190
  - cve.2026.93565

YARA Rule

rule CVE_2026_93565_Netty_RTSP_Trailing_Control_Byte
{
    meta:
        author      = "valtersit.com"
        description = "Detects RTSP method tokens terminated by a control byte (<= 0x20) before the separating space, targeting Netty RtspMethods.valueOf() normalization (CVE-2026-93565)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
        cve         = "CVE-2026-93565"
        date        = "2026-01-01"

    strings:
        $m1 = /(PLAY|PAUSE|RECORD|SETUP|TEARDOWN)[\x00-\x20] /
        $m2 = /(GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] /
        $rtsp = "RTSP/1.0"

    condition:
        $rtsp and any of ($m*)
}

Suricata IDS Rule

alert tcp any any -> any 554 (msg:"CVE-2026-93565 Netty RTSP method token with trailing control byte"; flow:established,to_server; content:"RTSP/1.0"; content:"|20 00 20|"; within:16; pcre:"/^(PLAY|PAUSE|RECORD|SETUP|TEARDOWN|GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] /"; classtype:attempted-admin; sid:202693565; rev:1; reference:cve,2026-93565; metadata:affected_product Netty, attack_target Server, created_at 2026_01_01, cve CVE_2026_93565, signature_severity Major;)

Note: the content:"|20 00 20|" anchor matches a NUL-delimited method token followed by a space; pair with pcre to reduce false positives on legitimate CR-truncated lines. Operators should tune the within offset to their environment.

Elastic Detection

network where process.name in ("java",) and
  network.transport == "tcp" and
  network.direction == "ingress" and
  data_stream.dataset == "network_traffic.flow" and
  event.original : "PLAY\x00 " or
  event.original : "PLAY\r " or
  event.original : "DESCRIBE\x00 " or
  event.original : "SETUP\x00 "

For environments where the raw RTSP line is captured in application logs, use:

any where process.name : "java" and
  message :~ /(PLAY|PAUSE|RECORD|SETUP|TEARDOWN|GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] /

Splunk SPL Query

index=network sourcetype=rtsp OR sourcetype=stream:tcp
| search "RTSP/1.0"
| regex _raw="(?i)(PLAY|PAUSE|RECORD|SETUP|TEARDOWN|GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] "
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="rtsp,netty,cve-2026-93565,">
  <rule id="100935" level="12">
    <decoded_as>rtsp</decoded_as>
    <regex type="pcre2">(?i)(PLAY|PAUSE|RECORD|SETUP|TEARDOWN|GET_PARAMETER|SET_PARAMETER|ANNOUNCE|DESCRIBE|OPTIONS)[\x00-\x20] </regex>
    <description>CVE-2026-93565: Netty RTSP method token with trailing control byte detected (RtspMethods.valueOf normalization bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93565,rtsp_parser_differential,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; Patch Sources: [], Vendor Fix: N/A, Workarounds: N/A. There is no vendor-supplied remediation to describe. The guidance below is defensive and must be validated against a future upstream fix.

1) Immediate mitigations (compensating controls)

• Deploy request-normalization controls at the network edge (reverse proxy, WAF, or load balancer) that reject or normalize RTSP request lines containing control bytes (code point ≤ 0x20) inside the method token before the byte stream reaches the Netty-based origin. This directly counters the parser-differential that the vulnerability creates.
• Enforce strict RTSP request-line grammar at inspection points: only the ten valid method tokens, followed by exactly one space, are permitted in the method position.
• Restrict external reachability of RTSP services to trusted networks where feasible (network segmentation, ACLs), reducing the attack surface reachable at AV:N.
• Enable raw-byte logging at ingress intermediaries so the original method token is preserved for auditing, since the Netty application layer records only a clean request.
• Monitor the detection rules above at high severity until a fix is available.

2) Patch / upgrade steps

• No patch currently exists per tracked sources. Track the upstream Netty project for a fix analogous to the HttpMethod hardening referenced in the description (issue references #16723 and #16971). When a fix is released, upgrade codec-rtsp / the Netty dependency to the fixed version and re-validate that RtspMethods.valueOf() no longer strips trailing control bytes prior to the cache lookup.
• Re-test mitigation controls after upgrade; do not assume the compensating controls remain necessary without confirmation.

3) Long-term hardening

• Establish a dependency-inventory process that flags Netty and specifically the RTSP codec, so that fixes to sibling classes (HTTP vs. RTSP) are tracked in parallel — the root cause here is a fix applied to one parser but not its RTSP analog.
• Add unit/fuzz tests that assert RtspMethods.valueOf() rejects method tokens with trailing control bytes and that RtspDecoder does not report decoderResult().isSuccess() == true for such inputs.
• Adopt parser-consistency testing across the request path (edge control vs. application) as a standing security requirement for any Netty-based service that faces semi-trusted networks.
• Apply least-privilege and strict method-allowlist enforcement at the application layer as defense in depth against method-token ambiguity.

References

• NVD — CVE-2026-93565: https://nvd.nist.gov/vuln/detail/CVE-2026-93565
• Netty project (upstream framework and codec-rtsp): https://netty.io/
• Netty source / issue tracker (sibling hardening references #16723 and #16971 cited in the NVD description): https://github.com/netty/netty/issues
• CWE-1035 — OWASP Top Ten 2017 Category A9: https://cwe.mitre.org/data/definitions/1035.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-93565 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public PoC, exploit code, or Nuclei template exists for CVE-2026-93565, and the CVE is not in CISA KEV. EPSS has not yet been scored by FIRST.org. All exploitation content in this report is inferred from the documented vulnerability class (trailing-control-byte normalization bypass in RtspMethods.valueOf()).