Description
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.
Published: 2026-08-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FreeRDP versions prior to 3.29.0 contain a resource exhaustion flaw that allows an attacker to send oversized chunked HTTP responses, causing the client to consume memory until the configured size limit is reached, which can lead to application crashes and denial of service.

Affected Systems

Multiple builds of the FreeRDP client shipped by the FreeRDP project, all versions earlier than 3.29.0.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data are unavailable, but the weakness remains serious where clients talk to an RD Gateway that the attacker can control. The flaw is listed as not yet in the CISA KEV catalog. Attackers would need network access to a malicious RD Gateway endpoint to feed oversized chunked HTTP responses to the client in order to exhaust its memory resources.

Generated by OpenCVE AI on August 2, 2026 at 03:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.29.0 or later
  • Set a reasonable RESPONSE_SIZE_LIMIT on the client to bound memory usage
  • Restrict RD Gateway access to trusted networks or authenticated users

Generated by OpenCVE AI on August 2, 2026 at 03:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 03 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 01 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.
Title FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-770
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T18:26:50.551Z

Reserved: 2026-07-29T13:01:57.548Z

Link: CVE-2026-67297

cve-icon Vulnrichment

Updated: 2026-08-03T18:26:46.303Z

cve-icon NVD

Status : Received

Published: 2026-08-01T13:16:58.967

Modified: 2026-08-03T19:16:50.280

Link: CVE-2026-67297

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-01T12:22:16Z

Links: CVE-2026-67297 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T03:30:14Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling