TLS Handshake Vulnerability in Flightctl Affects Red Hat Products
CVE-2026-120399

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Edge Manager 1
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120399?

A vulnerability exists in Flightctl due to a flaw in the TLS handshake process. This occurs synchronously in the connection-context callback of the HTTP server, leading to potential stalling. An unauthenticated network client can exploit this flaw by timing out the handshake, which will prevent the server from accepting new connections. It is crucial for users of Flightctl to address this issue to maintain the integrity of their network services.

References

https://access.redhat.com/security/cve/CVE-2026-120399
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564888
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Miroslav Kolář (TSP Data) for reporting this issue.
.