CVE-2026-116540

CVSS 8.2 (high) · published 2026-10-26

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Weakness: CWE-416

Source: NVD CVE-2026-116540

References

• https://github.com/netty/netty-tcnative
• https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365
• https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
• https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
• https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
• https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.