Vulnerability Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/
- https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.8
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
- https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-f
FAQ
What is CVE-2026-116540?
CVE-2026-116540 is a vulnerability with a CVSS score of 5.9 (MEDIUM). netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients perform...
How severe is CVE-2026-116540?
CVE-2026-116540 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116540?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.