{"id":26440,"date":"2026-09-19T00:31:37","date_gmt":"2026-09-18T16:31:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93565"},"modified":"2026-09-19T00:31:37","modified_gmt":"2026-09-18T16:31:37","slug":"cve-2026-93565","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93565","title":{"rendered":"CVE-2026-93565 [HIGH] &#8211; ### Summary\r\n`RtspMethods.valueOf()` silently strips trailing control bytes (any character"},"content":{"rendered":"<p>### Summary<br \/>\n`RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point &lt;= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte \u2014 for example `PLAYx00` or `PLAYr`, immediately before the separating space \u2014 is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean<br \/>\n`PLAY` request.<\/p>\n<p>This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup \u2014 meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it.<\/p>\n<p>### Reproduction<\/p>\n<p>Minimal wire-level reproduction<\/p>\n<p>Send the following raw bytes to any Netty-based RTSP server using R<\/p>\n","protected":false},"excerpt":{"rendered":"<p>### Summary<br \/>\n`RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26440","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}