CVE-2026-120399
Awaiting Analysis
Awaiting Analysis - Queue
TLS Handshake Denial of Service in flightctl
Vulnerability report for CVE-2026-120399, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: redhat-SADP
Description
Description
A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Red Hat | Red Hat Edge Manager 1 | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1322 | The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked. |
