EUVD-2026-51528
GHSA-5hp4-5mvq-qw3w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network flood in the pre-auth accept path (AV:N/AC:L/PR:N/UI:N) causing pure availability loss with no confidentiality or integrity impact (C:N/I:N/A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
AnalysisAI
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that gnome-remote-desktop is running in system mode with the RDP backend enabled and its listener (typically TCP 3389) reachable by the attacker; this specific deployment mode is the exact prerequisite drawn from the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction whose sole impact is high availability loss - no confidentiality or integrity impact, consistent with a pure DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a RHEL host running gnome-remote-desktop in system mode with RDP enabled repeatedly opens many parallel TCP connections to the RDP port without authenticating. Each connection is accepted and triggers a pending routing-token operation, and because the throttler is bypassed these accumulate until timeout, exhausting sockets and resources so legitimate users can no longer establish RDP sessions. … |
| Remediation | No vendor-released patch version is identified in the available data; monitor and apply the Red Hat errata referenced at https://access.redhat.com/security/cve/CVE-2026-18358 and Bugzilla 2462876 (https://bugzilla.redhat.com/show_bug.cgi?id=2462876), then update the gnome-remote-desktop package via 'dnf update gnome-remote-desktop' once the fixed NVR is published for your RHEL 8/9/10 release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all RHEL 8/9/10 systems where gnome-remote-desktop runs in system mode with RDP enabled and document network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today