Description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNOME | gnome-remote-desktop | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnome-remote-desktop | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gnome-remote-desktop | No fix yet | — |
| Ubuntu 26.04 LTS | gnome-remote-desktop | No fix yet | — |
| Ubuntu 24.04 LTS | gnome-remote-desktop | No fix yet | — |
| Ubuntu 22.04 LTS | gnome-remote-desktop | No fix yet | — |
| Ubuntu 20.04 LTS | gnome-remote-desktop | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gnome-remote-desktop | 49.3-4.el10_2 | RHSA-2026:54512 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gnome-remote-desktop | 49.3-4.el10_2 | ALSA-2026:54512 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gnome-remote-desktop | 49.3-4.el10_2 | RLSA-2026:54512 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | gnome-remote-desktop | 48.3-160000.3.1 | openSUSE-SU-2026:21888-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gnome-remote-desktop | 47.3-1.amzn2023.0.3 | ALAS2023-2026-2068 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gnome-remote-desktop | 49.3-4.el10_2 | ELSA-2026-54512 |
Advisories 7
- ALSA-2026:54512 Moderate: gnome-remote-desktop security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2829 Red Hat Enterprise Linux (gnome-remote-desktop): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 20, 2026
- openSUSE-SU-2026:21888-1 Security update for gnome-remote-desktop SUSE / openSUSE Security Updates · Sep 25, 2026
- ALAS2023-2026-2068 Important: gnome-remote-desktop security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 17, 2026
- RLSA-2026:54512 Moderate: gnome-remote-desktop security update Rocky Linux Security Advisories · Aug 14, 2026
- RHSA-2026:54512 Red Hat Security Advisory: gnome-remote-desktop security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- ELSA-2026-54512 Moderate: gnome-remote-desktop security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 13, 2026
References
- RHSA-2026:54512 vendor-advisory
- RHSA-2026:86194 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-18358 vdb-entry
- RHBZ#2462876 issue-tracking