The Memcache binary protocol codec in io.netty/netty-codec-memcache incorrectly reads the keyLength and extrasLength fields as signed Java types rather than unsigned as required by the protocol specification. A malicious Memcache server can exploit this mismatch by sending specially crafted responses that cause frame desynchronization and response smuggling. This flaw can result in cross-client data exposure in proxy or cache scenarios. The vulnerability is identified as CVE-2026-93561 with a CVSS 3.1 base score of 6.5, indicating medium severity. Multiple specific netty versions are affected as listed.

Exploitation of this vulnerability can lead to frame desynchronization and response smuggling, potentially causing data from one client to be exposed to another client's response stream in proxy or cache environments. This compromises confidentiality but does not affect availability. No known exploits in the wild have been reported.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions in environments where untrusted Memcache servers are present or where proxy/cache response isolation is critical.