CVE-2026-67297: FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Configuration
Ensure FreeRDP enforces RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body().
FreeRDP http_response_recv_body() RESPONSE_SIZE_LIMIT = enforce for Transfer-Encoding: chunked responses
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67297?
The severity of CVE-2026-67297 is high, with a CVSS score of 8.7.
What type of vulnerability is CVE-2026-67297?
CVE-2026-67297 is a resource exhaustion vulnerability caused by improper handling of chunked HTTP responses.
How do I fix CVE-2026-67297?
To fix CVE-2026-67297, upgrade FreeRDP to version 3.29.0 or later.
Who is affected by CVE-2026-67297?
All users of FreeRDP versions prior to 3.29.0 are affected by CVE-2026-67297.
What can an attacker do with CVE-2026-67297?
An attacker controlling a malicious RD Gateway can exploit CVE-2026-67297 to exhaust client memory resources.