CVE-2026-116540

high

Description

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

References

https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback

https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw

https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final

https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118

https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365

https://github.com/netty/netty-tcnative

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109910

Details

Source: Mitre, NVD

Published: 2026-10-26

Updated: 2026-10-26

Risk Information

CVSS v2

Base Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 8.2

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00459