CVE-2026-109832
Received Received - Intake

gnome-remote-desktop TLS Handler Denial of Service

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: redhat-SADP

Description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109832
EUVD
EUVD-2026-98475

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat gnome_remote_desktop *
gnome gnome-remote-desktop From 0.1.6-1 (inc) to 40.0-11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in gnome-remote-desktop for Red Hat Enterprise Linux. It involves improper handling of TLS retry errors in VNC I/O handlers, causing an infinite loop that consumes high CPU resources without progress. This leads to a denial of service by making the VNC service unavailable.

Detection Guidance

Check if gnome-remote-desktop is installed and running with VNC enabled. Use commands like 'rpm -qa | grep gnome-remote-desktop' to verify package version. Monitor CPU usage spikes on systems running gnome-remote-desktop with VNC TLS enabled. Check active network connections to VNC ports (default 5900) using 'ss -tulnp | grep 5900' or 'netstat -tulnp | grep 5900'.

Impact Analysis

An attacker with network access to an enabled VNC TLS listener can exploit this to cause high CPU usage and crash the VNC service. This results in loss of remote desktop access and potential system unavailability.

Mitigation Strategies
  • Disable the gnome-remote-desktop VNC service if not required using 'systemctl stop gnome-remote-desktop.service' and 'systemctl disable gnome-remote-desktop.service'.
  • If VNC must remain enabled, restrict access to trusted hosts using host-based firewall rules like 'firewall-cmd --add-rich-rule="rule family="ipv4" source address="trusted_ip" port port="5900" protocol="tcp" accept"'.
  • Update gnome-remote-desktop to the latest patched version if available through your package manager.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart