CVE-2026-67297

A vulnerability in FreeRDP allows a malicious RD Gateway to bypass client-side size limits by sending oversized chunked HTTP responses. This exhausts the client's memory, resulting in a Denial of Service (DoS).

A Moderate vulnerability in FreeRDP 3.x allows a malicious or compromised Remote Desktop Gateway to exhaust client memory by sending oversized chunked HTTP responses that bypass the 64 MiB size cap. This flaw affects FreeRDP 3.x clients connecting to untrusted endpoints; RHEL 9 and older releases ship earlier FreeRDP versions that lack this code path and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, FreeRDP clients should only connect to trusted Remote Desktop Gateway endpoints. Avoiding connections to untrusted or potentially compromised gateways will prevent exposure to malicious servers that could exploit this vulnerability by sending oversized chunked HTTP responses.