FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfo | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | Upgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-develUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-libs | Sep 2, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-debuginfo | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub