CVE-2026-18358
Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
CVE-2026-18358- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-05
EUVDEUVD-2026-51528
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
EUVD-2026-51528- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-5hp4-5mvq-qw3w
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon...
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
GHSA-5hp4-5mvq-qw3w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
CVE-2026-18358- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-18358
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
DEBIAN-CVE-2026-18358- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:54512
Red Hat Security Advisory: gnome-remote-desktop security update
- Record
RHSA-2026:54512- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRLSA-2026:54512
Moderate: gnome-remote-desktop security update
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
- gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:54512- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-18358
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
- Record
UBUNTU-CVE-2026-18358- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:54512 No score
Moderate: gnome-remote-desktop security update
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
- gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:54512- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21888-1 No score
Security update for gnome-remote-desktop
This update for gnome-remote-desktop fixes the following issue:
- CVE-2026-18358: system-mode RDP server missing connection throttling can allow unauthenticated denial of service (bsc#1273354).
- Record
openSUSE-SU-2026:21888-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-remote-desktopAlmaLinux:10 |
before 49.3-4.el10_2 | 49.3-4.el10_2 |
gnome-remote-desktopDebian:14 |
All versions, plus listed versions 48.1-448.2-149.0-149.1-149.1-2 Show 11 moreShow less49.2-149.2-249.2-349.2-450.1-150.1-250.1-350.1-550.2-150~beta-151.0-1 |
None known |
gnome-remote-desktopRed Hat:enterprise_linux:10.2 |
before 0:49.3-4.el10_2 | 0:49.3-4.el10_2 |
gnome-remote-desktop-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:49.3-4.el10_2 | 0:49.3-4.el10_2 |
gnome-remote-desktop-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:49.3-4.el10_2 | 0:49.3-4.el10_2 |
gnome-remote-desktopRocky Linux:10 |
before 0:49.3-4.el10_2 | 0:49.3-4.el10_2 |
gnome-remote-desktopUbuntu:20.04:LTS |
All versions, plus listed versions 0.1.7-1 |
None known |
gnome-remote-desktopUbuntu:22.04:LTS |
All versions, plus listed versions 40.2-141.0-141.1-341.2-142~beta-1 Show 11 moreShow less42~rc-142.0-142.0-242.0-4ubuntu142.1.1-0ubuntu142.2-0ubuntu142.3-0ubuntu142.4-0ubuntu142.7-0ubuntu142.9-0ubuntu0.22.04.142.9-0ubuntu0.22.04.2 |
None known |
gnome-remote-desktopUbuntu:24.04:LTS |
All versions, plus listed versions 45.0-145.1-145.1-1build146~rc-0ubuntu246.0-2 Show 5 moreShow less46.1-146.2-1~ubuntu24.04.246.3-0ubuntu146.3-0ubuntu1.146.3-0ubuntu1.2 |
None known |
gnome-remote-desktopUbuntu:26.10 |
All versions, plus listed versions 50.0-0ubuntu250.1-350.1-551~alpha-0ubuntu151~alpha-0ubuntu251.0-0ubuntu1 |
None known |
gnome-remote-desktopUbuntu:26.04:LTS |
All versions, plus listed versions 49.0-0ubuntu149.1-149.1-249.2-149.2-2 Show 6 moreShow less49.2-2ubuntu150~beta-150~rc-0ubuntu150.0-0ubuntu150.0-0ubuntu250.2-0ubuntu0.1 |
None known |
gnome-remote-desktopopenSUSE:Leap 16.0 |
before 48.3-160000.3.1 | 48.3-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-18358 is a high vulnerability (CVSS 7.5) in Gnome Gnome-remote-desktop, published July 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in gnome-remote-desktop 49.3-4.el10_2.
References
access.redhat.com/errata/RHSA-2026:54512
bugzilla.redhat.com/show_bug.cgi?id=2462876
nvd.nist.gov/vuln/detail/CVE-2026-18358
github.com/advisories/GHSA-5hp4-5mvq-qw3w
Show 10 moreShow less
errata.almalinux.org/10/ALSA-2026-54512.html
security-tracker.debian.org/tracker/CVE-2026-18358
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54512.json
cve.org/CVERecord?id=CVE-2026-18358
errata.rockylinux.org/RLSA-2026:54512
ubuntu.com/security/CVE-2026-18358
bugzilla.suse.com/1273354
suse.com/security/cve/CVE-2026-18358