DEBIAN-CVE-2026-93561
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.
DEBIAN-CVE-2026-93561
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-93561
netty
Source reference: /affected/0/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/0/versions1:4.1.48-11Source reference:
/affected/0/versions1:4.1.48-12Source reference:
/affected/0/versions1:4.1.48-13Source reference:
/affected/0/versions1:4.1.48-14Source reference:
/affected/0/versions1:4.1.48-15Source reference:
/affected/0/versions1:4.1.48-16Source reference:
/affected/0/versions1:4.1.48-7Source reference:
/affected/0/versions1:4.1.48-7+deb12u1Source reference:
/affected/0/versions1:4.1.48-7+deb12u2Source reference:
/affected/0/versions1:4.1.48-8Source reference:
/affected/0/versions1:4.1.48-9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/1/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/1/versions1:4.1.48-10+deb13u1Source reference:
/affected/1/versions1:4.1.48-11Source reference:
/affected/1/versions1:4.1.48-12Source reference:
/affected/1/versions1:4.1.48-13Source reference:
/affected/1/versions1:4.1.48-14Source reference:
/affected/1/versions1:4.1.48-15Source reference:
/affected/1/versions1:4.1.48-16Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/2/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/2/versions1:4.1.48-11Source reference:
/affected/2/versions1:4.1.48-12Source reference:
/affected/2/versions1:4.1.48-13Source reference:
/affected/2/versions1:4.1.48-14Source reference:
/affected/2/versions1:4.1.48-15Source reference:
/affected/2/versions1:4.1.48-16Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16",
"1:4.1.48-7",
"1:4.1.48-7+deb12u1",
"1:4.1.48-7+deb12u2",
"1:4.1.48-8",
"1:4.1.48-9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93561.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-10+deb13u1",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93561.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93561.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #18736 · Revision 1
- Added to Heist Feed
- Publisher date