CVE-2026-44296 Details
Description
Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.167, a remote, unauthenticated denial of service (DoS) vulnerability affects Deskflow servers running with TLS enabled (the default). When any TCP peer connects to the listening port and its first bytes do not parse as a valid TLS ClientHello, SecureSocket::secureAccept enters its fatal-error branch and calls Arch::sleep(1) (a blocking 1-second sleep) on the multiplexer worker thread. That thread services every socket on the server, including established TLS clients delivering mouse motion, keyboard events, and clipboard updates. A single failed handshake therefore stalls input delivery to all connected screens for ~1 second, and a sustained drip of malformed connections (≥ 1/s) makes the server effectively unusable while the attack persists. This vulnerability is fixed in 1.26.0.167.
A denial-of-service vulnerability has been identified in Deskflow, a keyboard and mouse sharing application, affecting versions prior to 1.26.0.167. The issue arises on servers with TLS enabled, which is the default configuration. When a TCP peer connects and the initial bytes do not constitute a valid TLS ClientHello, the SecureSocket::secureAccept function enters a fatal-error state. This triggers a blocking one-second sleep on the multiplexer worker thread, which manages all server sockets. As a result, input delivery from established TLS clients is halted for approximately one second, causing noticeable lag in mouse and keyboard input. Sustained attacks with malformed connections can render the server effectively unusable. The vulnerability does not affect clients or servers with TLS disabled.
Users can upgrade to Deskflow version 1.26.0.167 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, the server can be bound to trusted interfaces or the listening port can be firewalled to restrict access to intended client IPs. Disabling TLS is also an option, but not recommended due to the loss of encryption, and should only be considered on a fully trusted network.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/deskflow/deskflow/commit/329783490bd16774ba903b84212467d20d76bfba | [email protected] | Source CodeVendor |
| https://github.com/deskflow/deskflow/security/advisories/GHSA-3mxm-cgh2-6448 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-405 | Asymmetric Resource Consumption (Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Deskflow | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |