CVE-2026-93561 PUBLISHED

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 6.5

Product Status

Vendor Red Hat
Product Red Hat build of Apache Camel for Spring Boot 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Fuse 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: affected

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg for fixed versions and remediation guidance.

References

Problem Types

  • CWE-1035 CWE