Skip to content
Red HatCVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache

Medium6.5CVE-2026-93561 · Published Sep 18, 2026 · updated Sep 25, 2026

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Fuse 7
Product
all versionsNo fix yet
Red Hat JBoss Enterprise Application Platform 7
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Red Hat Single Sign-On 7
Product
all versionsNo fix yet
Red Hat build of Apache Camel for Spring Boot 4
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-1035

More Red Hat advisories

All Red Hat
Advisory
Red Hat OpenShift Container Platform 4: server-side request forgery
Critical9.3Sep 18
Red Hat Netty: request smuggling
Medium6.5Sep 18
Red Hat Netty: request smuggling
Medium6.5Sep 18
A flaw was found in cockpit-files
Medium6.1Sep 18
Red Hat cockpit-files. This vulnerability: race condition
Medium6.0Sep 18
Red Hat cockpit-files: race condition
Medium6.0Sep 18

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.