Live › vulnerability › CVE-2026-116540
Go to dashboardnetty-tcnative builds against OpenSSL 3.x can free session ticket keys while a TLS handshake is still reading them. Remote clients can crash the service or corrupt TLS ticket processing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Java services that use netty-tcnative with the OpenSSL provider on OpenSSL 3.x, and that accept TLS connections from remote clients. Services that use the JDK SSL provider, or that do not run session ticket key rotation, are less likely to be exposed, but the sources do not confirm the exact trigger conditions.
No product ranges from the sources yet.
mvn dependency:tree | grep tcnative or gradle dependencies | grep tcnative) and see whether it is 2.0.66.Final or later but before 2.0.84.Final.SslProvider.OPENSSL setup with session ticket keys set).2.0.84.Final or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
This page as .md · .json · in your agent: get_signal("CVE-2026-116540")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.