CVE-2026-42218

NameCVE-2026-42218
Descriptionxrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xrdp (PTS)bullseye0.9.21.1-1~deb11u1vulnerable
bullseye (security)0.9.21.1-1~deb11u3vulnerable
bookworm, bookworm (security)0.9.21.1-1+deb12u2vulnerable
trixie (security), trixie0.10.1-3.1+deb13u1vulnerable
sid0.10.6.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xrdpsourceexperimental0.10.6.1-1
xrdpsource(unstable)0.10.6.1-2

Notes

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3wr5-fwmh-qh34
Search for package or bug name: Reporting problems