Netty netty-tcnative: Use-after-free in session ticket key callback
Summary
netty-tcnative, a native TLS library for Java applications built against OpenSSL 3.x, contains a use-after-free in its session ticket key callback. A remote client that performs a TLS handshake while session ticket keys are being rotated can cause OpenSSL to read freed HMAC keys. An attacker can crash the application or disrupt session ticket processing; no confidentiality or integrity impact is claimed.
Affected
- netty-tcnative 2.0.66.Final before 2.0.84.Final, built against OpenSSL 3.x (per CVE record)
- The start of the affected range is disputed between sources (2.0.66.Final, 2.0.81.Final or up to 2.0.83.Final). Treat all versions below 2.0.84.Final as affected.
Fixed in
- Upgrade to netty-tcnative 2.0.84.Final or later.
Workaround
Unknown. No vendor-documented workaround. Changing session ticket settings is untested and may break session resumption; check with the application vendor first.
Exploitation
- No known exploitation.
- CISA SSVC: exploitation none, not automatable.
- No public exploit found.
Our recommendation
- Inventory Java services, fat JARs and container images for netty-tcnative, including transitive dependencies.
- Prioritise internet-facing services and upgrade to 2.0.84.Final or later in the next maintenance window.
- Ask vendors of bundled products for their patch status.
- Monitor for crashes or TLS errors in affected services after the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mmc8-vg2v-fvvw github.com
- netty-tcnative release 2.0.84.Final github.com
- Ubuntu security notice CVE-2026-116540 ubuntu.com
- VulDB CVE-2026-116540 vuldb.com
- VulnCheck advisory netty-tcnative www.vulncheck.com
- netty-tcnative project repository github.com
- OffSeq Radar CVE-2026-116540 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:55.
Original description (NVD)
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
NVD references (6)
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ss…
- https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
- https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-sessio…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.