# CVE-2026-44296: Deskflow denial of service via blocking sleep in TLS handshake

Source: https://junglewise.ai/threats/cve-2026-44296-deskflow-denial-of-service-via-blocking-sleep-in-tls-handshake  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44296 · Severity: high · CVSS 7.5 · Published 2026-05-12

Deskflow is an application that allows users to share a single keyboard and mouse across multiple computers. A flaw in how the software handles secure connections allows a remote attacker to freeze the application by sending malformed data. This results in significant input lag or a total loss of control over connected screens, effectively making the software unusable.

Technologies: [Deskflow](https://junglewise.ai/threats/technologies/deskflow). Vendors: [Deskflow](https://junglewise.ai/threats/vendors/deskflow).

## Quick answers

**Is CVE-2026-44296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44296 being exploited in the wild.

**How severe is CVE-2026-44296?** High severity, with a CVSS score of 7.5, published 12 May 2026.

**Which products and versions are affected?** Deskflow < 1.26.0.167.

**Is there a fix for CVE-2026-44296?** A patch was published on 2026-05-12: Fix committed and released in version 1.26.0.167 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44296 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44296?** Check whether you run Deskflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in Deskflow's TLS handshake handling within the SecureSocket::secureAccept function. When a remote, unauthenticated attacker connects to the server's listening port (default 24800) and sends data that does not parse as a valid TLS ClientHello, the server enters a fatal-error branch that executes a blocking 1-second sleep (Arch::sleep(1)). Because this sleep occurs on the primary multiplexer worker thread responsible for all active connections, it stalls input delivery (mouse, keyboard, and clipboard) for all connected clients. A sustained attack of one malformed connection per second is sufficient to render the server unusable. The issue is resolved in version 1.26.0.167 by removing the blocking sleep call.

## Affected products

- Deskflow Deskflow < 1.26.0.167

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix committed and released in version 1.26.0.167

## References

- [https://github.com/deskflow/deskflow/commit/329783490bd16774ba903b84212467d20d76bfba](https://github.com/deskflow/deskflow/commit/329783490bd16774ba903b84212467d20d76bfba)
- [https://github.com/deskflow/deskflow/security/advisories/GHSA-3mxm-cgh2-6448](https://github.com/deskflow/deskflow/security/advisories/GHSA-3mxm-cgh2-6448)

## Related threats

- [Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and…](https://junglewise.ai/threats/cve-2026-41477-deskflow-is-a-keyboard-and-mouse-sharing-app-in-1-20-0-1-26-0-134)
- [Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's…](https://junglewise.ai/threats/cve-2026-41476-deskflow-is-a-keyboard-and-mouse-sharing-app-prior-to-1-26-0-138)