Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:16 FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-770

FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

A vulnerability in FreeRDP allows a malicious RD Gateway to bypass client-side size limits by sending oversized chunked HTTP responses. This exhausts the client's memory, resulting in a Denial of Service (DoS).

A Moderate vulnerability in FreeRDP 3.x allows a malicious or compromised Remote Desktop Gateway to exhaust client memory by sending oversized chunked HTTP responses that bypass the 64 MiB size cap. This flaw affects FreeRDP 3.x clients connecting to untrusted endpoints; RHEL 9 and older releases ship earlier FreeRDP versions that lack this code path and are not affected. To mitigate this issue, FreeRDP clients should only connect to trusted Remote Desktop Gateway endpoints. Avoiding connections to untrusted or potentially compromised gateways will prevent exposure to malicious servers that could exploit this vulnerability by sending oversized chunked HTTP responses. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Not affected freerdp Red Hat Enterprise Linux 7 Not affected freerdp Red Hat Enterprise Linux 8 Not affected freerdp Red Hat Enterprise Linux 9 Not affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-67297 https://nvd.nist.gov/vuln/detail/CVE-2026-67297 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2c6r-4pr4-9x8m https://www.vulncheck.com/advisories/freerdp-before-resource-exhaustion-via-chunked-http-response