CVE-2026-18358 Denial of service in Red Hat Enterprise Linux 10
Unauthenticated attackers can cause denial of service in GNOME Remote Desktop system-mode RDP by bypassing connection throttling, affecting Red Hat Enterprise Linux.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18358?
CVE-2026-18358 is a high-severity denial of service vulnerability in GNOME Red Hat Enterprise Linux 10, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Weakness: CWE-400
Which versions are affected by CVE-2026-18358?
Linux distribution packages (6)
gnome-remote-desktop AlmaLinux:10 | All versions | 49.3-4.el10_2 |
gnome-remote-desktop Red Hat:enterprise_linux:10.2 | All versions | 0:49.3-4.el10_2 |
gnome-remote-desktop-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:49.3-4.el10_2 |
gnome-remote-desktop-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:49.3-4.el10_2 |
gnome-remote-desktop Rocky Linux:10 | All versions | 0:49.3-4.el10_2 |
gnome-remote-desktop openSUSE:Leap 16.0 | All versions | 48.3-160000.3.1 |
How do I fix CVE-2026-18358?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-18358 being exploited?
There is no known exploitation of CVE-2026-18358 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:54512, DEBIAN-CVE-2026-18358, GHSA-5hp4-5mvq-qw3w, RHSA-2026:54512, RLSA-2026:54512, UBUNTU-CVE-2026-18358 and 1 more.