Is CVE-2026-116540 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116540?

CVE-2026-116540 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-116540

Description

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.