CVE-2026-116540highCWE-416

CVE-2026-116540: fallo de gravedad alta en netty-tcnative

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

Publicada el

Seguir esta CVE+ Monitorear netty-tcnative+ Monitorear netty-tcnative

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 0.5%
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
netty · netty-tcnative
CVEs relacionadas — netty-tcnative

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-116541HIGHnetty-tcnative before 2.0.84.Final Denial of Service via BIO Write OvercountEPSS 0.5%CVE-2026-116539HIGHNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOEPSS 0.4%CVE-2026-116542MEDIUMNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingEPSS 0.2%