CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
- State
- Published
- Severity
- 8.2 High
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 26, 2026
Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
netty-tcnativenetty |
|
References
- GitHub Security Advisory (GHSA-mmc8-vg2v-fvvw)vendor-advisory
- Patch Commitpatch
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365technical-description
- netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notesrelease-notes
- https://github.com/netty/netty-tcnativeproduct
- VulnCheck Advisory: netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callbackthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.