CVE-2026-110836: FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in httpresponserecv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when a client connects through a malicious or attacker-controlled gateway.
What must an attacker do to trigger the denial of service?
The attacker must control the gateway and send a response with a nonzero Content-Length and an unrecognized Content-Type containing a semicolon. No client privileges are required, but user interaction is required because the client must connect to the gateway.
What is the operational impact on an affected client?
The crafted response causes http_response_recv() to loop indefinitely, pinning a client thread at full CPU. This can exhaust client CPU resources and deny service.