CVE-2026-120399

flightctl-api: flightctl-remote-access: flightctl: Unbounded TLS handshake in ConnContext can block accepting connections

flightctl-api

A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.

10. Nov 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-120399
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2564888
• NVD
  CVE-2026-120399