Moderate Vulnerability in gnome-remote-desktop: Unauthenticated Denial of Service Risk
Summary
RLSA-2026:54512: Moderate: gnome-remote-desktop security update. Affects gnome-remote-desktop versions < 0:49.3-4.el10_2. Fixed in 0:49.3-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNOME Remote Desktop is a remote desktop and screen sharing service designed for the GNOME desktop environment. It allows users to access their desktops remotely, facilitating collaboration and support. However, a recent security issue has been identified in the system-mode RDP server of gnome-remote-desktop, which lacks connection throttling, making it susceptible to denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-18358, arises from the absence of connection throttling in the gnome-remote-desktop system-mode RDP server. This flaw allows an attacker to overwhelm the server with connection requests, leading to a denial of service for legitimate users. The potential ramifications include service downtime and disruption of remote access capabilities, which can severely impact users relying on this service for remote work or support.
How To Fix
Minimum fixed version
0:49.3-4.el10_2
This is the first release that contains the fix.
sudo dnf update gnome-remote-desktopTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing firewall rules to limit the number of incoming connections to the gnome-remote-desktop service, thereby reducing the risk of denial of service attacks until the package can be updated.
Conclusion
The gnome-remote-desktop package has a moderate vulnerability (CVE-2026-18358) that poses a risk of denial of service due to missing connection throttling. Users are advised to update to the latest patched version to mitigate this risk. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for gnome-remote-desktop →
FAQ
CVE-2026-18358 is a security vulnerability in gnome-remote-desktop that allows unauthenticated denial of service due to missing connection throttling.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The main consequence is the potential for denial of service, which can disrupt remote access for legitimate users and affect productivity.
Yes, a patched version of gnome-remote-desktop is available. Updating to version 0:49.3-4.el10_2 or later will resolve the issue.
If you cannot update immediately, consider implementing firewall rules to limit incoming connections to the service as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for gnome-remote-desktop.
