NetSight
IP …
high7.5

CVE-2026-93565

A flaw was found in Netty RtspDecoder.

Impact

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

CWE-1035

References