FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-server | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | Upgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-devel | Sep 2, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsource | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub