CVE-2026-96541

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 12 Nov 2026 02:56:40 UTC. Read the latest advisory.

cve-program · CVE-2026-96541

Published

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-96541

Published

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:49.3-18.el10_3",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.3"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:40.0-13.el9_8",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_eus:9.8::appstream"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

gnome-remote-desktop

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gnome-remote-desktop",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON