Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A denial-of-service flaw was found in gnome-remote-desktop's RDP connection throttling. GrdThrottler charges an accepted TCP connection against the per-source and global connection limits before authentication, but no absolute deadline requires the peer to complete the RDP handshake. An unauthenticated remote attacker can therefore keep admitted sockets open indefinitely and retain all available slots. With the default limits, an attacker able to connect from two source IP addresses can hold five connections from each address, exhaust the ten global slots, and prevent new RDP handshakes until a holding connection closes. This is an incomplete resource-exhaustion fix for CVE-2025-5024. The issue begins with the introduction of GrdThrottler in commit 959cd39a and affects releases from 50.beta onward, including 50.0 through 50.2 and the reviewed 51 prereleases and main branch. Existing authenticated sessions were not shown to terminate, and no confidentiality, integrity, or code-execution impact is claimed. The upstream report includes a reproducer and reports no released fix at the time of filing. Reported to Red Hat through PSIRTSUPT-24484.
Fix is https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/merge_requests/436, and it should apply cleanly to rawhide and f45. There don't appear to be backports available upstream to GNOME 50 (f44) and 49 (f43, which itself patches in the vulnerable code)
Backport now exists for GNOME 50: https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/merge_requests/450
This will be a non-trivial backport to f43, because in addition to backporting the fix itself we'd need to backport the updated version of the VNC TLS patch. And f43 patches in the vulnerable code in the first place. f43 goes EOL in ~a month, and this is just a denial of service, so I think I'll just leave it as-is instead of trying to execute this complex backport
FEDORA-2026-29b06c5638 (gnome-remote-desktop-50.2-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-29b06c5638
FEDORA-2026-898c0e2c77 (gnome-remote-desktop-51.0-2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-898c0e2c77
FEDORA-2026-898c0e2c77 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-898c0e2c77` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-898c0e2c77 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-29b06c5638 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-29b06c5638` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-29b06c5638 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-898c0e2c77 (gnome-remote-desktop-51.0-2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-29b06c5638 (gnome-remote-desktop-50.2-2.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.