CVEvulnerability
CVE-2026-116540
8.2 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-26
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.2 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-416
Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- https://github.com/netty/netty-tcnative github.com
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365 github.com
- https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118 github.com
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final github.com
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw github.com
- https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback www.vulncheck.com