Use-after-free in netty-tcnative session ticket key callback
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
netty-tcnative from 2.0.66.Final before 2.0.84.Final, built against OpenSSL 3.x, contains a use-after-free flaw (CWE-416) in ssl_tlsext_ticket_key_cb during session ticket key rotation. The callback reads HMAC keys after setSessionTicketKeys0 has freed the shared key array. A remote client that performs TLS handshakes during the rotation can crash the process or corrupt ticket processing, and no authentication is needed.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade to netty-tcnative 2.0.84.Final. Red Hat Fuse 7 is affected and Red Hat plans no fix for it. The Red Hat build of Apache Camel for Spring Boot 4 is also affected, and the sources list no fixed version for it.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA netty-tcnative (netty) Fixed in 2.0.84.Final
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
netty-tcnative 2.0.84.Final
4 records Highest priority Priority HIGH 2 HIGH, 2 LOW
Other records, highest priority first
- TI-2026-80456 Heap buffer overflow in Netty netty-tcnative via OpenSSL BIOPriority HIGH 75
- TI-2026-80459 SNI hostname spoofing in Netty netty-tcnative via UTF-8 decodingPriority HIGH 70
- TI-2026-80458 Denial of service in Netty netty-tcnative via BIO write overcountPriority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116540
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-fgcj-53j7-r6vq
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Patch 1
More netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
- TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
Sources
- CVE-2026-116540 · CVE Program
- CVE-2026-116540 · NVD
- FIRST EPSS
- GHSA-fgcj-53j7-r6vq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116540 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences