{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/flightctl/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flightctl:flightctl:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120399"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["flightctl"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","cve-2026-120399","network-security"],"_cs_type":"advisory","_cs_vendors":["flightctl"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-120399) exists in flightctl where the HTTP server performs TLS handshakes synchronously within the connection-context callback. Because this process lacks a defined deadline, an unauthenticated, network-reachable attacker can initiate and intentionally stall the handshake. This exhaustion of connection slots prevents the listener from accepting new, legitimate connections, resulting in a denial-of-service condition.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a denial-of-service, preventing affected flightctl services from accepting new connections from legitimate clients. The CVSS v3.1 base score is 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit infrastructure to identify all network-exposed flightctl instances.\u003c/li\u003e\n\u003cli\u003eMonitor for increased volumes of incomplete or stalled TLS handshakes originating from external or untrusted network segments.\u003c/li\u003e\n\u003cli\u003ePrioritize the application of vendor-provided patches once available to address the lack of connection timeouts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:38:57Z","date_published":"2026-11-10T16:38:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-flightctl-dos/","summary":"A vulnerability in flightctl allows an unauthenticated, network-reachable attacker to cause a denial-of-service by stalling the TLS handshake process due to a lack of deadlines in the connection-context callback.","title":"flightctl: Denial of Service via synchronous TLS handshake (CVE-2026-120399)","url":"https://feed.craftedsignal.io/briefs/2026-11-flightctl-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Flightctl","version":"https://jsonfeed.org/version/1.1"}