---
id: "CVE-2026-120399"
page: "https://infrastack.ai/live/CVE-2026-120399"
kind: "vulnerability"
aliases: ["CVE-2026-120399"]
title: "flightctl: unauthenticated TLS handshake stall blocks new server connections"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["dos", "flightctl", "other", "self-hosted"]
not_affected_if: ["auth-required", "listener-not-exposed"]
published_at: "2026-11-10T14:17:14+00:00"
first_seen_at: "2026-11-10T14:22:13+00:00"
updated_at: "2026-11-10T14:25:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120399", "first_seen_at": "2026-11-10T14:22:13+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-120399", "first_seen_at": "2026-11-10T14:25:01+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-120399"]}]
exploit_sources: []
---

# flightctl: unauthenticated TLS handshake stall blocks new server connections

Link for people: https://infrastack.ai/live/CVE-2026-120399 (this .md is for agents)

flightctl does a TLS handshake synchronously in the HTTP server's connection-context callback with no deadline. An unauthenticated network client that stalls the handshake stops the listener accepting new connections; existing connections are not affected. Red Hat rates it CVSS 7.5 (preliminary); no fixed version is published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Affected versions are not published yet. Check whether your flightctl API/agent-facing listener is reachable from untrusted networks. Red Hat's interim detection: periodically check the listener's Recv-Q (e.g. ss -ltn); if it is non-zero, the accept queue is stalled.

## Fix

No fixed version published as of 2026-11-10 (Red Hat page lists none).

## Timeline

- 2026-11-10T14:22:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120399
- 2026-11-10T14:25:01+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-120399 — Correction: no field is marked verified; the Red Hat page does not name affected versions or configuration, so who_affected stays unverified.

## Documents

- [advisory] Red Hat CVE-2026-120399 (flightctl) https://access.redhat.com/security/cve/CVE-2026-120399

## From the sources

A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_