CVE-2026-96541
HighCVSS 7.5Summary
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
Risk Assessment
An attacker can prevent legitimate users from using the RDP service, leading to denial of service.
Recommendation
Apply available patches or update gnome-remote-desktop to a version that enforces a pre-authentication handshake deadline.
Other vulnerabilities in gnome-remote-desktop
See all- CVE-2026-18358High
In gnome-remote-desktop as shipped in Red Hat Enterprise Linux, when the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections, exhausting resources and preventing legitimate users from establishing RDP sessions.
- CVE-2025-5024High
A flaw in gnome-remote-desktop allows an unauthenticated attacker to exhaust system resources and repeatedly crash the process. After many attacks, a resource leak may prevent gnome-remote-desktop from opening files even after a systemd restart.
Original NVD description (English source)
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.