Skip to content
High Severity CVE-2026-120399 Vulnerability in flightctl Allows Denial of Service

High Severity CVE-2026-120399 Vulnerability in flightctl Allows Denial of Service

First seen 10 Nov 2026, 22:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 22:50 UTC
  • •CVE-2026-120399 allows unauthenticated denial of new connections in flightctl.
  • •Exploitation requires network access; existing connections are not affected.
  • •Temporary workarounds include monitoring the receive queue and restarting the server.

Red Hat disclosed CVE-2026-120399, a high-severity vulnerability in flightctl that allows unauthenticated clients to block new connections by stalling TLS handshakes. This issue arises from synchronous TLS handshakes without timeouts, impacting service availability. The affected products include several packages of Red Hat Edge Manager 1. Exploitation requires network access to the agent endpoint, but existing connections remain unaffected. Recovery can be achieved by restarting the server and blocking malicious devices. Temporary workarounds involve monitoring the listener's receive queue and terminating idle connections. The CVSS score for this vulnerability is 7.5, indicating a high severity level. As of now, the CVE status is awaiting further analysis from the NVD.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-10
CVE-2026-120399 published
Red Hat disclosed a high-severity vulnerability in flightctl affecting service availability due to unbounded TLS handshakes.
Smartscope.Blog
2026-11-10
Red Hat advisory released
Red Hat provided details on the vulnerability, including recovery methods and affected products.
access.redhat.com

More articles in this cluster (3)

Following this threat?

Track Red Hat and CVE-2026-120399 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

Which products are affected by CVE-2026-120399?
The affected products include flightctl-api and flightctl-remote-access container packages in Red Hat Edge Manager 1.
What is the severity of this vulnerability?
CVE-2026-120399 has a CVSS score of 7.5, indicating a high severity level.
How can I mitigate the impact of this vulnerability?
You can mitigate the impact by restarting the server and blocking any malicious devices on the network.