netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.84.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
netty-tcnative, a library that provides OpenSSL-based TLS support for the Netty networking framework, is affected when built against OpenSSL 3.x. A remote attacker performing TLS handshakes during session ticket key rotation could cause the server to crash or corrupt session ticket processing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- io.netty:netty-tcnative
From 2.0.66.Final · fixed in 2.0.84.Final