CVE-2026-116540

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

CVSS 4.0

8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-416

Published

2026-10-26

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

References

• https://github.com/netty/netty-tcnative
• https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365
• https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
• https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
• https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw

Check your stackJSON