CVE-2026-93565 describes a flaw in the RtspMethods.valueOf() function of Netty's RtspDecoder, where trailing control bytes are incorrectly stripped from method tokens in RTSP requests. An attacker can send specially crafted RTSP requests to exploit this behavior, leading to method-token smuggling. This can bypass method-based access controls and allow malicious requests to be laundered through Netty-based RTSP proxies, making them appear legitimate to backend systems.

The vulnerability allows remote attackers to bypass method-based access controls in RTSP services using Netty, potentially enabling unauthorized actions or access. It also facilitates laundering of malicious requests through RTSP proxies, which may lead to backend systems processing unauthorized or harmful requests under the guise of legitimate ones. There is no indication of confidentiality or availability impact, but integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or patch links were provided in the input data.