Description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
Published: 2026-10-13
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service via high CPU consumption
Action: Apply Workaround
AI Analysis

Impact

A flaw in the gnome-remote-desktop VNC TLS input/output handling causes retryable GnuTLS results to trigger an unbounded busy loop instead of yielding to the event loop. This leads to the event-loop thread spinning at high CPU with no forward progress, giving a remote attacker who can reach an enabled VNC TLS listener the ability to cause a denial-of-service condition. The weakness is a classic case of uncontrolled resource consumption (CWE-835).

Affected Systems

Affected systems are Red Hat Enterprise Linux 8, 9 and 10, where gnome-remote-desktop is included in the standard RHEL distribution.

Risk and Exploitability

The CVSS score of 7.5 categorises this vulnerability as high severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalogue. The attack surface is remote; an attacker only needs network access to a VNC TLS listener to trigger the busy loop, leading to CPU exhaustion and service disruption without requiring additional privileges.

Generated by OpenCVE AI on October 13, 2026 at 13:51 UTC.

Remediation

Vendor Workaround

If VNC is not required, disable the gnome-remote-desktop VNC service. If it must remain enabled, restrict the VNC listener to trusted hosts or management networks using host-based firewall rules.

OpenCVE Recommended Actions

  • Disable the gnome-remote-desktop VNC service if it is not required.
  • Restrict the VNC listener to trusted hosts or management networks using host-based firewall rules.
  • Apply Red Hat security updates that include the fix for this issue.

Generated by OpenCVE AI on October 13, 2026 at 13:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
Title Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-835
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-13T13:01:20.322Z

Reserved: 2026-10-13T06:16:06.797Z

Link: CVE-2026-109832

cve-icon Vulnrichment

Updated: 2026-10-13T13:01:14.275Z

cve-icon NVD

Status : Received

Published: 2026-10-13T12:17:14.033

Modified: 2026-10-13T13:17:29.320

Link: CVE-2026-109832

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T14:00:09Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')