Infinite Loop Vulnerability in FreeRDP Software by FreeRDP

CVE-2026-110836

What is CVE-2026-110836?

An infinite loop vulnerability exists in the FreeRDP software, impacting versions 3.0.0 to 3.31.0. This issue arises from the function http_response_recv(), where malicious gateways can exploit the software by sending crafted Content-Type headers. Specifically, attackers can specify a non-zero Content-Length value along with a semicolon-containing unrecognized Content-Type, forcing a client thread to enter a perpetual CPU-intensive state. This can lead to resource exhaustion for the affected client, disrupting service and leading to denial of service.

References