There are 2 open security issues in trixie.
1 important issue:
- CVE-2026-18358:
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
1 issue left for the package maintainer to handle:
- CVE-2025-5024:
(needs triaging)
A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.
You can find information about how to handle this issue in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/gnome-remote-desktop.png){kind=link}