Threats tagged 'ghsa-9f6q-cw24-v4xv'

A vulnerability in flightctl causes the TLS handshake to be performed synchronously without a deadline in the HTTP server's connection-context callback. This allows a network-reachable unauthenticated client to stall the handshake process, preventing the affected listener from accepting new connections and resulting in a denial of service. Existing connections remain unaffected after exploitation. Recovery requires restarting the server and blocking the malicious client at the network level. A temporary workaround involves monitoring the listener's Recv-Q and terminating idle connections.