Executive brief
Netty's Memcache binary protocol codec mishandles field parsing by treating unsigned integers as signed Java types, allowing a malicious Memcache server to send crafted responses that desynchronize the frame stream. In proxy or cache environments where multiple clients share a connection, this can cause one client's data to leak into another client's response, exposing sensitive information.
Technical details
The netty-codec-memcache library incorrectly reads keyLength and extrasLength fields as signed integers instead of unsigned values per the Memcache binary protocol specification. An attacker controlling a Memcache server can exploit this type mismatch by crafting oversized or negative-appearing values that cause frame desynchronization and response smuggling between clients sharing the same pooled connection.
Affected products
- io.netty netty-codec-memcache
Timeline
- 2026-09-18: disclosed