Use-After-Free Vulnerability in Netty-tcnative by Netty
CVE-2026-116540

8.2HIGH

Key Information:

Vendor

Netty

Status
Netty-tcnative
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116540?

A use-after-free vulnerability exists in netty-tcnative versions prior to 2.0.84.Final, particularly during session ticket key rotation in the ssl_tlsext_ticket_key_cb function. This vulnerability arises when remote clients conduct TLS handshakes while session ticket keys are being set, leading to a freeing of the shared key array. Consequently, OpenSSL attempts to access freed HMAC keys, which can cause crashing or corruption in the ticket processing mechanism. It is essential for users to update to the patched version to mitigate this issue.

Affected Version(s)

netty-tcnative 2.0.66.Final < 2.0.84.Final

References

https://github.com/netty/netty-tcnative/security/advisori...
vendor-advisory
https://github.com/netty/netty-tcnative/commit/59662a8b07...
patch
https://github.com/netty/netty-tcnative/blob/netty-tcnati...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.