Is CVE-2026-116540 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116540 being exploited in the wild.

How severe is CVE-2026-116540?

Medium severity, with a CVSS score of 5.9, published 26 October 2026.

Which products and versions are affected?

Netty TCNative 2.0.66.Final through 2.0.83.Final (when built against OpenSSL 3.x).

Is there a fix for CVE-2026-116540?

Yes: fixed in 2.0.84.Final. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116540 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116540?

Check whether you run Netty TCNative at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116540: Netty TCNative use-after-free in session ticket key rotation

CVE-2026-116540 · Severity: medium · CVSS 5.9 · Published 2026-10-26

Netty TCNative is a library that provides native TLS/SSL support for Java applications. A use-after-free vulnerability in versions 2.0.66 through 2.0.83 (when built against OpenSSL 3.x) can cause remote TLS clients to crash the application or corrupt ticket processing during session ticket key rotation. An attacker can trigger this by performing TLS handshakes while the server rotates session ticket keys.

Technologies: Netty TCNative. Vendors: Netty.

Quick answers

Is CVE-2026-116540 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116540 being exploited in the wild.
How severe is CVE-2026-116540?: Medium severity, with a CVSS score of 5.9, published 26 October 2026.
Which products and versions are affected?: Netty TCNative 2.0.66.Final through 2.0.83.Final (when built against OpenSSL 3.x).
Is there a fix for CVE-2026-116540?: Yes: fixed in 2.0.84.Final. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116540 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116540?: Check whether you run Netty TCNative at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.84.Final

Technical details

The vulnerability is a use-after-free in the ssl_tlsext_ticket_key_cb callback during session ticket key rotation. When setSessionTicketKeys0 frees the shared key array, concurrent TLS handshakes may still attempt to read the freed HMAC keys from OpenSSL, leading to denial of service or data corruption. The issue affects only builds linked against OpenSSL 3.x and requires network access to trigger via TLS handshakes.

Affected products

Netty TCNative 2.0.66.Final through 2.0.83.Final (when built against OpenSSL 3.x)

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.