REDHAT-BUG-2509986: Medium severity FreeRDP freerdp vulnerability

Q: Who is exposed to this issue?

FreeRDP clients using versions before 3.29.0 are exposed when they connect through an RD Gateway endpoint controlled by an attacker. The issue affects handling of chunked HTTP responses from that gateway.

Q: What does an attacker need to exploit it?

An attacker needs control of a malicious RD Gateway endpoint and must cause a vulnerable FreeRDP client to process oversized Transfer-Encoding: chunked HTTP response bodies. The result is client memory resource exhaustion.

Q: Does configuring a response size limit prevent exploitation?

No. In affected versions, the configured RESPONSE_SIZE_LIMIT is not enforced for chunked HTTP response bodies processed by http_response_recv_body().

Q: What version resolves the issue?

FreeRDP 3.29.0 and later enforce the response size limit for this processing path. Systems running a version before 3.29.0 should be considered affected when using untrusted or attacker-controlled RD Gateway endpoints.

Published Aug 1, 2026

Updated

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

Affected Software

1 affected component

FreeRDP freerdp<3.29.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.29.0

Event History

Aug 1, 2026

Data Sourced

via Red Hat·01:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients using versions before 3.29.0 are exposed when they connect through an RD Gateway endpoint controlled by an attacker. The issue affects handling of chunked HTTP responses from that gateway.

What does an attacker need to exploit it?

An attacker needs control of a malicious RD Gateway endpoint and must cause a vulnerable FreeRDP client to process oversized Transfer-Encoding: chunked HTTP response bodies. The result is client memory resource exhaustion.

Does configuring a response size limit prevent exploitation?

No. In affected versions, the configured RESPONSE_SIZE_LIMIT is not enforced for chunked HTTP response bodies processed by http_response_recv_body().

What version resolves the issue?

FreeRDP 3.29.0 and later enforce the response size limit for this processing path. Systems running a version before 3.29.0 should be considered affected when using untrusted or attacker-controlled RD Gateway endpoints.

REDHAT-BUG-2509986: Medium severity FreeRDP freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does configuring a response size limit prevent exploitation?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does configuring a response size limit prevent exploitation?

What version resolves the issue?