CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free…
- Risk score
- 45/100
- CVSS
- 5.9 v3.1
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashi…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.84 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: openssl
References
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365
- https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
- https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback
Original description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Last activity 26 Oct 2026. Patch Forecast updates every hour.