A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.
The services can be recovered by restarting the server and blocking the malicious device at network level.
As a temporary workaround, you can schedule a recurrent check on the listener's Recv-Q; when the queue is non-zero, this terminates idle connections that have received almost no data.