CVE-2025-49178

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore

MEDIUM

5.5

CVSS Score

Published: June 17, 2025 at 02:54 PM UTC

Updated: June 30, 2026 at 11:16 AM UTC

2 products affected across 2 vendorsEnterprise LinuxXwayland

Using Red Hat Enterprise Linux 10 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 10 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 0:1.1.0-25.el6_10.1 (unaffected)

Vendor states this is fixed in 0:1.11.0-22.el9_0.15 (unaffected)

Vendor states this is fixed in 0:1.11.0-8.el8_4.13 (unaffected)

Vendor states this is fixed in 0:1.12.0-14.el9_2.12 (unaffected)

Vendor states this is fixed in 0:1.12.0-15.el8_8.14 (unaffected)

Vendor states this is fixed in 0:1.12.0-6.el8_6.14 (unaffected)

Vendor states this is fixed in 0:1.13.1-8.el9_4.7 (unaffected)

Vendor states this is fixed in 0:1.14.1-8.el9_6 (unaffected)

Vendor states this is fixed in 0:1.15.0-7.el8_10 (unaffected)

Vendor states this is fixed in 0:1.20.10-2.el8_4 (unaffected)

Vendor states this is fixed in 0:1.20.11-11.el9_0 (unaffected)

Vendor states this is fixed in 0:1.20.11-16.el8_8 (unaffected)

Vendor states this is fixed in 0:1.20.11-18.el9_2 (unaffected)

Vendor states this is fixed in 0:1.20.11-26.el8_10 (unaffected)

Vendor states this is fixed in 0:1.20.11-26.el9_4 (unaffected)

Vendor states this is fixed in 0:1.20.11-31.el9_6 (unaffected)

Vendor states this is fixed in 0:1.20.11-5.el8_6.3 (unaffected)

Vendor states this is fixed in 0:1.20.4-32.el7_9 (unaffected)

Vendor states this is fixed in 0:1.20.6-4.el8_2 (unaffected)

Vendor states this is fixed in 0:1.8.0-36.el7_9.2 (unaffected)

Vendor states this is fixed in 0:1.9.0-15.el8_2.14 (unaffected)

Vendor states this is fixed in 0:21.1.3-11.el8_8 (unaffected)

Vendor states this is fixed in 0:21.1.3-18.el8_10 (unaffected)

Vendor states this is fixed in 0:21.1.3-2.el8_6.4 (unaffected)

Vendor states this is fixed in 0:21.1.3-3.el9_0 (unaffected)

Vendor states this is fixed in 0:21.1.3-8.el9_2 (unaffected)

Vendor states this is fixed in 0:22.1.9-6.el9_4 (unaffected)

Vendor states this is fixed in 0:23.2.7-4.el9_6 (unaffected)

Vendor states this is fixed in 0:24.1.5-4.el10_0 (unaffected)

Xwayland · X Org

60%

v < 24.1.7

Affected range stops below 24.1.7, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references