CVE-2026-32854

A flaw was found in LibVNCServer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted HTTP requests. The flaw exists in the HTTP proxy handlers, where missing validation of certain return values can lead to a null pointer dereference, causing the server to crash. This impacts the availability of the server when HTTPD and proxy features are enabled.

The availability impact of this flaw is limited on Red Hat products. While an attacker may be able to induce a crash in the LibVNCServer the host Red Hat system's availability is not at risk. Additionally, unless configured otherwise Red Hat Linux will automatically reboot LibVNCServer in the event of a crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.