CVE-2026-109832

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-109832

Published

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-109832

Published

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:40.0-13.el9_9",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9::appstream"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:40.0-13.el9_8",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_eus:9.8::appstream"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON