Quick answers
- Is CVE-2026-44296 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44296 being exploited in the wild.
- How severe is CVE-2026-44296?
- High severity, with a CVSS score of 7.5, published 12 May 2026.
- Which products and versions are affected?
- Deskflow < 1.26.0.167.
- Is there a fix for CVE-2026-44296?
- A patch was published on 2026-05-12: Fix committed and released in version 1.26.0.167 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44296 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44296?
- Check whether you run Deskflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial of service vulnerability exists in Deskflow's TLS handshake handling within the SecureSocket::secureAccept function. When a remote, unauthenticated attacker connects to the server's listening port (default 24800) and sends data that does not parse as a valid TLS ClientHello, the server enters a fatal-error branch that executes a blocking 1-second sleep (Arch::sleep(1)). Because this sleep occurs on the primary multiplexer worker thread responsible for all active connections, it stalls input delivery (mouse, keyboard, and clipboard) for all connected clients. A sustained attack of one malformed connection per second is sufficient to render the server unusable. The issue is resolved in version 1.26.0.167 by removing the blocking sleep call.
Affected products
- Deskflow Deskflow < 1.26.0.167
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix committed and released in version 1.26.0.167