UBUNTU-CVE-2026-116540: Ubuntu/netty-tcnative vulnerability

Published Oct 26, 2026

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Affected Software

7 affected components

ubuntu/netty-tcnative*

Event History

Oct 26, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using netty-tcnative versions from 2.0.66.Final before 2.0.84.Final that are built against OpenSSL 3.x are exposed.

What must occur for an attacker to trigger the vulnerability?

A remote client must perform TLS handshakes while session ticket keys are being rotated through setSessionTicketKeys0. This race can cause OpenSSL to read freed HMAC keys.

What could exploitation cause?

The described outcome is a crash or corruption of TLS session ticket processing.

UBUNTU-CVE-2026-116540: Ubuntu/netty-tcnative vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must occur for an attacker to trigger the vulnerability?

What could exploitation cause?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must occur for an attacker to trigger the vulnerability?

What could exploitation cause?