CVE-2026-96541

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

This Moderate-impact denial-of-service flaw in gnome-remote-desktop allows an unauthenticated remote attacker to prevent new RDP connections. By holding open unauthenticated RDP sockets indefinitely, an attacker can exhaust the default global connection limit. Exploitation requires connecting from at least two distinct source IP addresses to fully utilize the default per-source and global connection limits. Existing authenticated RDP sessions remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the RDP listener when it is not required, or restrict access to the RDP port to trusted networks or hosts at the network boundary. No application-level mitigation that preserves unrestricted RDP access is known.