Medium severity · published Oct 26, 2026
CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
New
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty-tcnative · netty
2.0.66.Final before 2.0.84.Final · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116540
github.com
https://github.com/netty/netty-tcnative
github.com
https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365
github.com
https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
github.com
https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
github.com
https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
www.vulncheck.com
https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback
More from netty-tcnative
5.9
CVE-2026-116541
netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
5.9
CVE-2026-116539
Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
5.3
CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding