Deskflow is a keyboard and mouse sharing application. Before version 1.26.0.167, any TCP connection that does not begin with a valid TLS ClientHello triggers a one‑second blocking sleep on the server’s multiplexer worker thread. Because that worker services all active sockets, even legitimate TLS clients experience a one‑second pause, which, when repeated, effectively blocks input delivery to all connected screens. The weakness corresponds to uncontrolled resource consumption and improper handling of malformed input, reflected in CWE‑400 and CWE‑405.

The vulnerability affects Deskflow servers running any pre‑1.26.0.167 release with TLS enabled, which is the default configuration. It is not limited to a specific operating system; any platform that runs Deskflow with TLS listening on its port is susceptible.

The CVSS score of 7.5 indicates a high severity remote vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public nature of TCP listeners means an attacker can freely target the server. Because no authentication or special privileges are required, a simple traffic generator can repeatedly send malformed ClientHello messages to induce sustained DoS. Each failed handshake introduces a one‑second pause, and flooding the server at a rate of one per second or higher will keep the service unusably slow for any connected clients.