CVE-2026-109941: FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in httpchunckedread that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions from 2.3.0 up to, but not including, 3.32.0 are exposed when they communicate with an attacker-controlled or malicious RD Gateway.
What must an attacker do to trigger the hang?
The attacker must cause the client to process a chunked HTTP response from an RD Gateway, then send an incomplete chunk-size line or footer and perform a clean TLS shutdown. This can make zero-byte reads repeat indefinitely and freeze the client decoder thread.
What is the operational impact of successful exploitation?
Successful exploitation causes a denial of service by hanging the affected FreeRDP client decoder thread. The provided information does not indicate confidentiality or integrity impact.
What version resolves the issue?
Upgrade FreeRDP to version 3.32.0 or later. Versions before 3.32.0 are affected starting with 2.3.0.