Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96541: A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gnome-remote-desktop | 0:47.3-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gnome-remote-desktop-debuginfo | 0:47.3-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gnome-remote-desktop-debugsource | 0:47.3-1.amzn2023.0.5 |
Vulnerabilities 1
-
High 7.5
Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline i…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96541.html