CVE-2026-116540highCWE-416

CVE-2026-116540: falha de alta gravidade em netty-tcnative

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

Publicada em

Seguir esta CVE+ Monitorar netty-tcnative+ Monitorar netty-tcnative

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.5%
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
netty · netty-tcnative
CVEs relacionadas — netty-tcnative

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116541HIGHnetty-tcnative before 2.0.84.Final Denial of Service via BIO Write OvercountEPSS 0.5%CVE-2026-116539HIGHNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOEPSS 0.4%CVE-2026-116542MEDIUMNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingEPSS 0.2%