FreeRDP versions 3.0.0 through 3.31.9 contain an infinite loop within the http_response_recv() function. The loop is triggered when a gateway returns a nonzero Content-Length header paired with a Content-Type that includes a semicolon and is otherwise unrecognized. The result is that a client thread becomes trapped in the loop, consuming all available CPU resources indefinitely and rendering the client unresponsive. This vulnerability is categorized as CWE-835, an infinite loop weakness.

The affected product is FreeRDP, the open-source RDP client. All releases from 3.0.0 up to but not including 3.32.0 are susceptible. The issue applies to any installation of FreeRDP that connects through a gateway capable of sending HTTP responses.

The CVSS score of 7.1 indicates a high severity vulnerability. Because no public exploit code is available and the attacker must control an RDP gateway, exploitation requires proximity to the gateway infrastructure. The EPSS score is not currently available, and the vulnerability is not listed in the CISA KEV catalog. The exact impact depends on the volume of traffic sent by the malicious gateway, but an attacker can effectively perform a denial of service against individual clients by exhausting CPU cycles.