CVE-2026-96541 in Red Hat
Summary
by MITRE • 09/23/2026
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in gnome-remote-desktop represents a significant denial-of-service risk stemming from a failure to enforce authentication deadlines during the Remote Desktop Protocol handshake process. This flaw allows unauthenticated remote attackers to exploit the connection management logic by initiating RDP connections without completing the required pre-authentication steps. Specifically, the application fails to implement or respect a timeout mechanism for incomplete handshakes, which permits an attacker to open multiple sessions and retain their associated resource slots indefinitely. In normal operation, gnome-remote-desktop manages concurrent user access through a global connection limit designed to prevent system overload and ensure fair resource allocation among legitimate users. However, the absence of a pre-authentication handshake deadline means that malicious actors can bypass this protective measure by establishing connections that remain in an open but unauthenticated state.
From a technical perspective, the core issue lies in the socket handling logic within the RDP server implementation. When a client initiates a connection, the system allocates resources to manage potential future authentication and data transfer. Under standard security practices, if these resources are not utilized for valid authentication within a specified timeframe, they should be released back to the pool or forcibly closed to prevent resource exhaustion. In this vulnerable scenario, the lack of enforcement allows holding sockets to persist without consuming CPU cycles actively but still occupying critical connection slots in the global limit counter. This behavior effectively creates a resource leak where each incomplete handshake consumes one unit of the total available capacity for authenticated sessions.
The operational impact of this vulnerability is severe for any system relying on gnome-remote-desktop for remote access capabilities. By systematically opening and maintaining these invalid connections, an attacker can exhaust the global connection limit entirely. Once this threshold is reached, legitimate users are unable to establish new RDP sessions because all available slots are occupied by malicious holding sockets. This results in a complete denial of service for authorized administrators or end-users who require remote access to the affected machine. The attack does not require any form of authentication credentials, making it particularly dangerous as it can be executed by unauthenticated adversaries over the network with minimal effort and no prior compromise of user accounts.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting through resource exhaustion via connection flooding. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Denial of Service attacks where an adversary aims to disrupt service availability by consuming system resources such as network connections or memory. The exploitation vector is remote and unauthenticated, placing it within high-risk categories for internet-facing services that utilize RDP protocols without adequate hardening against connection-based abuse.
Mitigation strategies should focus on implementing strict timeout mechanisms for all pre-authentication stages of the RDP handshake process. System administrators can enforce a maximum duration for incomplete connections to ensure that holding sockets are automatically closed if authentication is not completed within a reasonable timeframe, such as thirty seconds or less depending on network latency requirements. Additionally, deploying rate-limiting rules at the firewall level can help mitigate bulk connection attempts by restricting the number of new RDP sessions allowed from a single IP address over a given period. Updating gnome-remote-desktop to versions that include patches for this specific flaw is essential, as upstream developers typically address such logic errors by introducing explicit deadline checks and enforcing session cleanup procedures for abandoned connections. Until updates are applied, limiting exposure through network segmentation or disabling the service if not strictly required can reduce the attack surface significantly.