Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-93561 EUVD-2026-82864GHSA-7p33-hhxj-4qcr

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

Published Sep 18, 2026 · Updated Sep 25, 2026 · Assigned by redhat

Description

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Apache Camel for Spring Boot 4 — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat Single Sign-On 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

Advisories 1

References