Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Published: 2026-10-26
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

This vulnerability is a use‑after‑free in the ssl_tlsext_ticket_key_cb function of netty‑tcnative's OpenSSL integration, triggered during session ticket key rotation. When a remote client performs a TLS handshake while setSessionTicketKeys0 has already freed the shared key array, OpenSSL attempts to read freed HMAC keys, crashing or corrupting ticket processing. The impact is a denial of service to TLS connections, affecting confidentiality and availability of secure communications.

Affected Systems

The affected product is Netty Netty‑tcnative. Versions 2.0.66.Final through 2.0.83.Final are vulnerable; the fix is delivered in 2.0.84.Final and later. Any application that links against a vulnerable netty‑tcnative library built against OpenSSL 3.x is at risk.

Risk and Exploitability

The CVSS score of 8.2 classifies this as a high‑severity flaw, and although EPSS data is not available, the exploitability is clear from the description: a remote client can trigger the crash simply by initiating a TLS handshake that leverages session ticket key rotation. The flaw is not listed in the CISA KEV catalog, but its high impact warrants immediate attention.

Generated by OpenCVE AI on October 26, 2026 at 16:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the netty-tcnative library to version 2.0.84.Final or later, which removes the use‑after‑free in ssl_tlsext_ticket_key_cb.
  • If an upgrade cannot be applied immediately, reconfigure the application to avoid calling setSessionTicketKeys0 during TLS handshakes or disable session ticket key rotation in OpenSSL to prevent the vulnerable code path from executing.
  • Restart the affected services after the change and monitor TLS error logs to verify that crashes no longer occur.

Generated by OpenCVE AI on October 26, 2026 at 16:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Title netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T16:15:16.184Z

Reserved: 2026-10-26T14:30:57.662Z

Link: CVE-2026-116540

cve-icon Vulnrichment

Updated: 2026-10-26T15:38:08.999Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T16:17:19.377

Modified: 2026-10-26T17:17:27.187

Link: CVE-2026-116540

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:30:11Z

Weaknesses