{"id":"CVE-2026-120399","kind":"vulnerability","aliases":["CVE-2026-120399"],"related":[],"title":"flightctl: unauthenticated TLS handshake stall blocks new server connections","description":"A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.","summary":"flightctl does a TLS handshake synchronously in the HTTP server's connection-context callback with no deadline. An unauthenticated network client that stalls the handshake stops the listener accepting new connections; existing connections are not affected. Red Hat rates it CVSS 7.5 (preliminary); no fixed version is published yet.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dos","flightctl","other","self-hosted"],"not_affected_if":["auth-required","listener-not-exposed"],"how_to_check":"Affected versions are not published yet. Check whether your flightctl API/agent-facing listener is reachable from untrusted networks. Red Hat's interim detection: periodically check the listener's Recv-Q (e.g. ss -ltn); if it is non-zero, the accept queue is stalled.","fix":"No fixed version published as of 2026-11-10 (Red Hat page lists none).","status":"open","published_at":"2026-11-10T14:17:14+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","triaged_at":"2026-11-10T14:23:51+00:00","updated_at":"2026-11-10T14:25:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T14:23:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"flightctl: unauthenticated TLS handshake stall blocks new server connections","impact":"low","summary":"flightctl performs a TLS handshake synchronously in the HTTP server's connection-context callback with no deadline. A network client that never finishes the handshake can keep the listener from accepting new connections.","audience":"businesses","category":"other","nicknames":[],"who_cares":["flightctl","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Denial of service: the listener stops accepting new connections.","analyst_note":"Confirm affected flightctl versions and the fixed release from the project's advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120399.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams that run flightctl with its HTTP listener reachable from the network are exposed, since the stalled handshake needs no account. The sources do not name the affected versions or the configuration needed, so check whether your flightctl deployment exposes that listener. Deployments that keep the listener off untrusted networks can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4510,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected flightctl versions and the fixed release from the project's advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120399.","search":"'-120399':12A,15A '-2026':11A,14A '7.5':64B 'accept':51B,112C 'affect':58B,109C 'block':6A 'callback':36B,92C 'client':43B,101C 'connect':9A,34B,53B,55B,90C,114C 'connection-context':33B,89C 'context':35B,91C 'cve':10A,13A 'cvss':63B 'deadlin':39B,95C 'dos':16B 'exist':54B 'fix':67B 'flaw':73C 'flightctl':1A,17B,22B,77C 'found':75C 'handshak':4A,26B,47B,80C,105C 'hat':60B 'host':21B 'http':30B,86C 'listen':50B,110C 'network':42B,98C 'network-reach':97C 'new':7A,52B,113C 'perform':82C 'preliminari':65B 'prevent':107C 'publish':70B 'rate':61B 'reachabl':99C 'red':59B 'self':20B 'self-host':19B 'server':8A,31B,87C 'stall':5A,45B,103C 'stop':48B 'synchron':27B,83C 'tls':3A,25B,79C 'unauthent':2A,41B,100C 'version':68B 'without':93C 'yet':71B","nicknames":[],"mitigations":[],"who_affected":"Teams that run flightctl with its HTTP listener reachable from the network are exposed, since the stalled handshake needs no account. The sources do not name the affected versions or the configuration needed, so check whether your flightctl deployment exposes that listener. Deployments that keep the listener off untrusted networks can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-10T14:25:01Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-120399","run_id":2458}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dos","flightctl","high","other","selfhosted"],"campaign_type":null,"search_a":"'-120399':12A,15A '-2026':11A,14A 'block':6A 'connect':9A 'cve':10A,13A 'flightctl':1A 'handshak':4A 'new':7A 'server':8A 'stall':5A 'tls':3A 'unauthent':2A","search_b":"'7.5':64B 'accept':51B 'affect':58B 'callback':36B 'client':43B 'connect':34B,53B,55B 'connection-context':33B 'context':35B 'cvss':63B 'deadlin':39B 'dos':16B 'exist':54B 'fix':67B 'flightctl':17B,22B 'handshak':26B,47B 'hat':60B 'host':21B 'http':30B 'listen':50B 'network':42B 'new':52B 'preliminari':65B 'publish':70B 'rate':61B 'red':59B 'self':20B 'self-host':19B 'server':31B 'stall':45B 'stop':48B 'synchron':27B 'tls':25B 'unauthent':41B 'version':68B 'yet':71B","search_c":"'accept':112C 'affect':109C 'callback':92C 'client':101C 'connect':90C,114C 'connection-context':89C 'context':91C 'deadlin':95C 'flaw':73C 'flightctl':77C 'found':75C 'handshak':80C,105C 'http':86C 'listen':110C 'network':98C 'network-reach':97C 'new':113C 'perform':82C 'prevent':107C 'reachabl':99C 'server':87C 'stall':103C 'synchron':83C 'tls':79C 'unauthent':100C 'without':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120399","severity":null,"published_at":"2026-11-10T14:17:14+00:00","modified_at":"2026-11-10T14:17:14+00:00","first_seen_at":"2026-11-10T14:22:13+00:00","fetched_at":"2026-11-10T14:22:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120399:2458","url":"https://access.redhat.com/security/cve/CVE-2026-120399","severity":null,"published_at":"2026-11-10T14:25:01+00:00","modified_at":"2026-11-10T14:25:06+00:00","first_seen_at":"2026-11-10T14:25:01+00:00","fetched_at":"2026-11-10T14:25:06+00:00","note":"Correction: no field is marked verified; the Red Hat page does not name affected versions or configuration, so who_affected stays unverified.","cites":["https://access.redhat.com/security/cve/CVE-2026-120399"]}],"documents":[{"id":115468,"url":"https://access.redhat.com/security/cve/CVE-2026-120399","title":"Red Hat CVE-2026-120399 (flightctl)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}