CVE-2026-93561
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat build of Apache Camel for Spring Boot 4
- Vendor
- Red Hat
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- Platforms
- Unknown
- Default status
affected- Package
- netty-codec-memcache
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Fuse 7
- Vendor
- Red Hat
- Product
- Red Hat Fuse 7
- Platforms
- Unknown
- Default status
unaffected- Package
- netty-codec-memcache
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7
- Platforms
- Unknown
- Default status
affected- Package
- jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7
- Platforms
- Unknown
- Default status
affected- Package
- jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7
- Platforms
- Unknown
- Default status
affected- Package
- jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7
- Platforms
- Unknown
- Default status
affected- Package
- netty-codec-memcache
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat Single Sign-On 7
- Vendor
- Red Hat
- Product
- Red Hat Single Sign-On 7
- Platforms
- Unknown
- Default status
affected- Package
- netty-codec-memcache
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.