flightctl: Denial of Service via synchronous TLS handshake (CVE-2026-120399)

A vulnerability (CVE-2026-120399) exists in flightctl where the HTTP server performs TLS handshakes synchronously within the connection-context callback. Because this process lacks a defined deadline, an unauthenticated, network-reachable attacker can initiate and intentionally stall the handshake. This exhaustion of connection slots prevents the listener from accepting new, legitimate connections, resulting in a denial-of-service condition.

Impact

The vulnerability results in a denial-of-service, preventing affected flightctl services from accepting new connections from legitimate clients. The CVSS v3.1 base score is 7.5.

Recommendation

• Audit infrastructure to identify all network-exposed flightctl instances.
• Monitor for increased volumes of incomplete or stalled TLS handshakes originating from external or untrusted network segments.
• Prioritize the application of vendor-provided patches once available to address the lack of connection timeouts.