CVE-2026-116540

Name of the Vulnerable Software and Affected Versions netty-tcnative versions 2.0.66.Final through 2.0.83.Final

Description When built against OpenSSL 3.x, a use-after-free issue occurs during session ticket key rotation. This happens when remote clients perform TLS handshakes while the setSessionTicketKeys0 function frees the shared key array, leading OpenSSL to read freed HMAC keys. This can result in the corruption of ticket processing or a system crash. The issue is located within the ssl tlsext ticket key cb function.

Recommendations Update netty-tcnative to version 2.0.84.Final.