CVE-2026-44296: Deskflow TLS DoS Vulnerability

CVE-2026-44296 Overview

CVE-2026-44296 is a remote, unauthenticated denial of service (DoS) vulnerability in Deskflow, an open-source keyboard and mouse sharing application. Versions prior to 1.26.0.167 running with TLS enabled (the default configuration) are affected. When a TCP peer connects to the listening port and sends data that does not parse as a valid TLS ClientHello, the SecureSocket::secureAccept function enters a fatal-error branch and invokes Arch::sleep(1) on the multiplexer worker thread. That thread services every connected socket, so a single failed handshake stalls input delivery to all clients for approximately one second.

Critical Impact

A sustained drip of malformed TCP connections at one per second or higher renders the Deskflow server effectively unusable, blocking mouse, keyboard, and clipboard events to all connected screens.

Affected Products

• Deskflow versions prior to 1.26.0.167
• Deskflow servers with TLS enabled (default configuration)
• All operating systems running vulnerable Deskflow builds

Discovery Timeline

• 2026-05-12 - CVE-2026-44296 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44296

Vulnerability Analysis

The vulnerability resides in src/lib/net/SecureSocket.cpp within the SecureSocket::secureAccept routine. When TLS negotiation fails fatally, the code logs an error and calls Arch::sleep(1). The intent was to throttle hammering on the socket, but the sleep executes on the multiplexer worker thread that drives I/O for every connected client. The blocking call freezes input delivery, clipboard synchronization, and screen switching across the entire Deskflow deployment.

The weakness maps to [CWE-400: Uncontrolled Resource Consumption]. An attacker only needs to open a TCP connection to the Deskflow listening port and send arbitrary non-TLS bytes. No authentication, credentials, or user interaction are required.

Root Cause

The root cause is a blocking sleep placed on a shared worker thread that multiplexes every socket the server handles. The handler treats a failed TLS handshake as a localized error but applies a server-wide stall as the mitigation. Because the multiplexer is single-threaded for socket servicing, any time spent sleeping blocks all other clients from receiving events.

Attack Vector

An attacker reaches the Deskflow server over the network and opens TCP sessions to its listening port. Each session sends bytes that fail to parse as a valid ClientHello. One failure per second is sufficient to maintain a continuous freeze of legitimate input. The attack requires no privileges and no interaction from a legitimate user.

// Patch in src/lib/net/SecureSocket.cpp
// fix(tls): prevent DoS by removing blocking sleep
   checkResult(r, retry);
 
   if (isFatal()) {
-    // tell user and sleep so the socket isn't hammered.
+    // Never block here; this thread services every connected socket.
+    // Historically a 1s sleep let any failed handshake DoS all clients.
     LOG_ERR("failed to accept secure socket");
-    LOG_WARN("client connection may not be secure");
     m_secureReady = false;
-    Arch::sleep(1);
     retry = 0;
-    return -1; // Failed, error out
+    return -1; // Fail
   }
 
   // If not fatal and no retry, state is good

Source: GitHub Commit 3297834

Detection Methods for CVE-2026-44296

Indicators of Compromise

• Repeated failed to accept secure socket entries in Deskflow server logs within short time windows
• Bursts of short-lived TCP connections to the Deskflow listening port from a single source
• User reports of input lag, frozen cursor, or delayed clipboard sync coinciding with the log entries

Detection Strategies

• Alert when the rate of LOG_ERR("failed to accept secure socket") messages exceeds a baseline of one per minute
• Correlate spikes in TCP SYN and RST activity on the Deskflow port with simultaneous input delivery delays
• Monitor for connections to the Deskflow port from sources outside the expected client allow list

Monitoring Recommendations

• Forward Deskflow server logs to a central log platform and build a dashboard around failed TLS handshakes
• Capture netflow or connection-tracking data on the host running the Deskflow server to baseline normal client connection patterns
• Track end-user telemetry such as input event latency to identify DoS conditions in progress

How to Mitigate CVE-2026-44296

Immediate Actions Required

• Upgrade all Deskflow servers to version 1.26.0.167 or later
• Restrict network access to the Deskflow listening port using a host firewall or network ACL so only known client IPs can connect
• Inventory all hosts running Deskflow and verify the installed version against the fixed release

Patch Information

The fix landed in commit 329783490bd16774ba903b84212467d20d76bfba and is included in Deskflow 1.26.0.167. The patch removes the Arch::sleep(1) call and the secondary LOG_WARN from the fatal branch of SecureSocket::secureAccept, returning -1 immediately. See the GitHub Security Advisory GHSA-3mxm-cgh2-6448 for full details.

Workarounds

• Bind the Deskflow server to a loopback or management interface and tunnel client traffic through VPN or SSH
• Place the Deskflow listener behind a firewall rule that allows only trusted client subnets
• Rate-limit inbound connections to the Deskflow port at the network edge to slow malformed handshake bursts

# Example: restrict Deskflow port 24800 to a trusted client subnet using iptables
iptables -A INPUT -p tcp --dport 24800 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 24800 -j DROP