Bug 2539563

Summary: CVE-2026-96541 gnome-remote-desktop: gnome-remote-desktop: unauthenticated RDP sockets lack a handshake deadline [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: gnome-remote-desktopAssignee: Jonas Ådahl <jadahl>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: gnome-sig, jadahl
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["13ebe925-6ed4-4773-8c31-7bea20104a11"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2539385    

Description Vladimir Vasilev 2026-09-23 17:18:10 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A denial-of-service flaw was found in gnome-remote-desktop's RDP connection throttling. GrdThrottler charges an accepted TCP connection against the per-source and global connection limits before authentication, but no absolute deadline requires the peer to complete the RDP handshake. An unauthenticated remote attacker can therefore keep admitted sockets open indefinitely and retain all available slots. With the default limits, an attacker able to connect from two source IP addresses can hold five connections from each address, exhaust the ten global slots, and prevent new RDP handshakes until a holding connection closes. This is an incomplete resource-exhaustion fix for CVE-2025-5024. The issue begins with the introduction of GrdThrottler in commit 959cd39a and affects releases from 50.beta onward, including 50.0 through 50.2 and the reviewed 51 prereleases and main branch. Existing authenticated sessions were not shown to terminate, and no confidentiality, integrity, or code-execution impact is claimed. The upstream report includes a reproducer and reports no released fix at the time of filing. Reported to Red Hat through PSIRTSUPT-24484.