CVE-2026-110836 — FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type he…
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7