What’s Vulnerable › Vulnerabilities

CVE-2026-116540: netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-26
• Weakness: CWE-416

Description

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Affected products

• netty-tcnative: from 2.0.66.Final before 2.0.84.Final — fixed in 2.0.84.Final

How to fix

Upgrade to a fixed version: netty-tcnative 2.0.84.Final. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty-tcnative
• https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365
• https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
• https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
• https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
• https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback

Get alerted when CVE-2026-116540 or the next vulnerability affects your stack