CVE-2026-96541: Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
Other sources
A denial-of-service flaw was found in gnome-remote-desktop's RDP connection throttling. GrdThrottler charges an accepted TCP connection against the per-source and global connection limits before authentication, but no absolute deadline requires the peer to complete the RDP handshake. An unauthenticated remote attacker can therefore keep admitted sockets open indefinitely and retain all available slots. With the default limits, an attacker able to connect from two source IP addresses can hold five connections from each address, exhaust the ten global slots, and prevent new RDP handshakes until a holding connection closes. This is an incomplete resource-exhaustion fix for CVE-2025-5024. The issue begins with the introduction of GrdThrottler in commit 959cd39a and affects releases from 50.beta onward, including 50.0 through 50.2 and the reviewed 51 prereleases and main branch. Existing authenticated sessions were not shown to terminate, and no confidentiality, integrity, or code-execution impact is claimed. The upstream report includes a reproducer and reports no released fix at the time of filing. Reported to Red Hat through PSIRTSUPT-24484.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this denial of service?
Systems running gnome-remote-desktop with RDP reachable by an unauthenticated remote attacker are exposed. The attacker does not need valid RDP credentials because connection slots are consumed before authentication.
What does an attacker need to do to exhaust the default connection capacity?
The attacker must open RDP TCP connections and leave their handshakes incomplete. Under the stated default limits, connections from two source IP addresses can hold five slots each and exhaust all ten global slots.
What is the operational effect once the slots are exhausted?
New RDP clients cannot complete new handshakes while the global connection limit is exhausted. Service becomes available again only when a holding socket closes.
Is this limited to a non-default or specially configured deployment?
No. The described exhaustion scenario uses the default limits: five connections per source and ten connections globally.
How can defenders reduce exposure before a fix is available?
Restrict unauthenticated network access to the RDP service, particularly from untrusted source addresses. This limits an attacker’s ability to create and retain the pre-authentication connections required for exhaustion.