{"id":"CVE-2026-116540","kind":"vulnerability","aliases":["CVE-2026-116540"],"related":[],"title":"netty-tcnative: use-after-free in TLS session ticket key rotation","description":"netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.","summary":"netty-tcnative builds against OpenSSL 3.x can free session ticket keys while a TLS handshake is still reading them. Remote clients can crash the service or corrupt TLS ticket processing.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","netty","package","self-hosted","tls"],"not_affected_if":["jdk-ssl-provider"],"how_to_check":"- Check the netty-tcnative version in the dependency tree (for example `mvn dependency:tree | grep tcnative` or `gradle dependencies | grep tcnative`) and see whether it is `2.0.66.Final` or later but before `2.0.84.Final`.\n- Check whether the service uses session tickets with OpenSSL-backed Netty SSL (for example a `SslProvider.OPENSSL` setup with session ticket keys set).","fix":"- Upgrade netty-tcnative to `2.0.84.Final` or later.\n- Rebuild and redeploy the service after the dependency change.","status":"open","published_at":"2026-10-26T16:17:19+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:32:47+00:00","updated_at":"2026-10-26T16:32:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:32:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade netty-tcnative to `2.0.84.Final` or later.\n- Rebuild and redeploy the service after the dependency change.","reach":"internet","title":"netty-tcnative: use-after-free in TLS session ticket key rotation","impact":"medium","summary":"netty-tcnative builds against OpenSSL 3.x can free session ticket keys while a TLS handshake is still reading them. Remote clients can crash the service or corrupt TLS ticket processing.","category":"package","nicknames":[],"who_cares":["java","netty","tls","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote clients crash the TLS service or corrupt session ticket handling","analyst_note":"Confirm the exact trigger conditions and whether a crash or code execution is possible; the NVD entry in the sources does not say.","how_to_check":"- Check the netty-tcnative version in the dependency tree (for example `mvn dependency:tree | grep tcnative` or `gradle dependencies | grep tcnative`) and see whether it is `2.0.66.Final` or later but before `2.0.84.Final`.\n- Check whether the service uses session tickets with OpenSSL-backed Netty SSL (for example a `SslProvider.OPENSSL` setup with session ticket keys set).","needs_analyst":true,"not_affected_if":["jdk-ssl-provider"],"who_is_affected":"Java services that use netty-tcnative with the OpenSSL provider on OpenSSL 3.x, and that accept TLS connections from remote clients. Services that use the JDK SSL provider, or that do not run session ticket key rotation, are less likely to be exposed, but the sources do not confirm the exact trigger conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":3378,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116540':16A,19A '-2026':15A,18A '2.0.66.final':62C '2.0.84.final':64C '3':33B,68C 'array':99C 'build':30B 'built':65C 'caus':100C 'cb':82C 'client':49B,89C 'contain':70C 'corrupt':55B,109C 'crash':51B,107C 'cve':14A,17A 'free':7A,36B,75C,95C 'freed':104C 'handshak':43B,92C 'hmac':105C 'host':25B 'java':20B 'key':12A,39B,81C,86C,98C,106C 'netti':2A,21B,28B,60C 'netty-tcn':1A,27B,59C 'openssl':32B,67C,101C 'packag':22B 'perform':90C 'process':58B,111C 'read':46B,103C 'remot':48B,88C 'rotat':13A,87C 'self':24B 'self-host':23B 'servic':53B 'session':10A,37B,84C 'setsessionticketkeys0':94C 'share':97C 'ssl':78C 'still':45B 'tcnativ':3A,29B,61C 'ticket':11A,38B,57B,80C,85C,110C 'tls':9A,26B,42B,56B,91C 'tlsext':79C 'use':5A,73C 'use-after-fre':4A,72C 'vulner':76C 'x':34B,69C","nicknames":[],"mitigations":[],"who_affected":"Java services that use netty-tcnative with the OpenSSL provider on OpenSSL 3.x, and that accept TLS connections from remote clients. Services that use the JDK SSL provider, or that do not run session ticket key rotation, are less likely to be exposed, but the sources do not confirm the exact trigger conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116540","severity":null,"published_at":"2026-10-26T16:17:19+00:00","modified_at":"2026-10-26T16:17:19+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}