Cpe:2.3:a:flightctl:flightctl:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aflightctlflightctl/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:38:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgflightctl: Denial of Service via synchronous TLS handshake (CVE-2026-120399)https://feed.craftedsignal.io/briefs/2026-11-flightctl-dos/Tue, 10 Nov 2026 16:38:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-flightctl-dos/A vulnerability in flightctl allows an unauthenticated, network-reachable attacker to cause a denial-of-service by stalling the TLS handshake process due to a lack of deadlines in the connection-context callback.A vulnerability (CVE-2026-120399) exists in flightctl where the HTTP server performs TLS handshakes synchronously within the connection-context callback. Because this process lacks a defined deadline, an unauthenticated, network-reachable attacker can initiate and intentionally stall the handshake. This exhaustion of connection slots prevents the listener from accepting new, legitimate connections, resulting in a denial-of-service condition.

Impact

The vulnerability results in a denial-of-service, preventing affected flightctl services from accepting new connections from legitimate clients. The CVSS v3.1 base score is 7.5.

Recommendation

  • Audit infrastructure to identify all network-exposed flightctl instances.
  • Monitor for increased volumes of incomplete or stalled TLS handshakes originating from external or untrusted network segments.
  • Prioritize the application of vendor-provided patches once available to address the lack of connection timeouts.
]]>lowadvisorydenial-of-servicecve-2026-120399network-security