CVE-2026-116540: netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
netty-tcnativeto a version that resolves this vulnerability.Fixed in 2.0.84.Final
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using netty-tcnative versions from 2.0.66.Final before 2.0.84.Final, built against OpenSSL 3.x, are affected when session ticket keys are rotated.
What must an attacker do to trigger the issue?
A remote client must perform TLS handshakes while the application calls setSessionTicketKeys0 and frees the shared session-ticket key array. Exploitation does not require authentication or user interaction, but depends on this timing race during key rotation.
What is the immediate mitigation if upgrading is not possible?
Avoid rotating session ticket keys with setSessionTicketKeys0 while remote TLS handshakes may occur. Upgrade netty-tcnative to 2.0.84.Final or later when possible.
How can I determine whether an instance is exposed?
Verify the deployed netty-tcnative version and whether it was built against OpenSSL 3.x. Instances running a version before 2.0.84.Final should also be checked for use of session ticket key rotation through setSessionTicketKeys0.