CVE-2026-116540GHSA-mmc8-vg2v-fvvw
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
netty netty-tcnativeFrameworks
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.0.84.Finalnetty-tcnativeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Text from CVE List
Affected versions 1
- netty-tcnativeaffected: 2.0.66.Final before 2.0.84.FinalCVE List
References 6
- github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118Fixvia CVE List
- github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.FinalFixvia CVE List
- github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvwAdvisoryvia CVE List
- vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callbackAdvisoryvia CVE List
- github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365Referencevia CVE List
- github.com/netty/netty-tcnativeReferencevia CVE List