CVE-2026-67297: FreeRDP DOS Vulnerability

CVE-2026-67297 Overview

CVE-2026-67297 is a resource exhaustion vulnerability in FreeRDP versions prior to 3.29.0. The flaw resides in the http_response_recv_body() function, which fails to enforce the RESPONSE_SIZE_LIMIT when processing HTTP responses using Transfer-Encoding: chunked. An attacker controlling a malicious Remote Desktop (RD) Gateway endpoint can return oversized chunked response bodies to a connecting FreeRDP client. Because the size limit is not honored on chunked responses, the client continues to allocate memory until resources are exhausted. The issue is categorized under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A malicious RD Gateway can exhaust memory on a connecting FreeRDP client, causing denial of service on the client host.

Affected Products

FreeRDP versions prior to 3.29.0
FreeRDP-based clients that connect to remote RD Gateway endpoints
Downstream applications and distributions that bundle vulnerable FreeRDP libraries

Discovery Timeline

2026-08-01 - CVE-2026-67297 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67297

Vulnerability Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP). When a client connects through an RD Gateway, the negotiation includes HTTP responses processed by http_response_recv_body(). FreeRDP defines RESPONSE_SIZE_LIMIT to cap the maximum body size the client will accept from a peer. On the standard code path this limit is validated as bytes are read from the socket.

The chunked transfer path is different. When the peer sends Transfer-Encoding: chunked, the body is delivered as a sequence of size-prefixed chunks that are concatenated into the response buffer. In vulnerable versions, this concatenation loop does not consult RESPONSE_SIZE_LIMIT, so the aggregate body may grow without bound.

A malicious server can therefore stream arbitrarily large chunked content to force continued allocation on the client. The result is memory exhaustion and denial of service on the client process or host. There is no impact to confidentiality or integrity — the flaw is availability-only.

Root Cause

The root cause is a missing enforcement check on the chunked response branch of http_response_recv_body(). The size cap that guards the non-chunked path is not applied when reassembling chunks, allowing the accumulated body length to exceed RESPONSE_SIZE_LIMIT.

Attack Vector

Exploitation requires the FreeRDP client to initiate an outbound connection to a server the attacker controls or has compromised. The attacker configures the endpoint to respond with Transfer-Encoding: chunked and streams oversized chunks. No authentication or user interaction beyond initiating the connection is required. See the FreeRDP GitHub Security Advisory and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-67297

Indicators of Compromise

FreeRDP client processes with abnormal, sustained memory growth during or immediately after RD Gateway connections
Client-side out-of-memory (OOM) terminations or system OOM-killer events correlated with xfreerdp, wfreerdp, or embedded FreeRDP processes
Outbound RDP-over-HTTPS connections to untrusted or newly observed RD Gateway hosts

Detection Strategies

Inventory FreeRDP binaries and libraries across managed endpoints and flag any version earlier than 3.29.0
Inspect proxy and TLS metadata for HTTP responses to RD Gateway clients that use Transfer-Encoding: chunked with unusually large aggregate body sizes
Alert on FreeRDP client processes whose resident set size exceeds a baseline threshold within a short window after a new outbound RDP session

Monitoring Recommendations

Log outbound connections from workstations to external RD Gateway endpoints and review any destinations outside sanctioned infrastructure
Track process memory metrics for RDP client binaries and generate alerts on rapid allocation spikes
Forward endpoint and network telemetry to a centralized data lake for correlation of process, memory, and network signals

How to Mitigate CVE-2026-67297

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all systems where the library or xfreerdp client is installed
Rebuild and redeploy any third-party applications that statically link or bundle FreeRDP against the fixed version
Restrict outbound RDP and RD Gateway connections to known, trusted destinations via firewall or proxy egress rules

Patch Information

The vulnerability is fixed in FreeRDP 3.29.0. The upstream fix enforces RESPONSE_SIZE_LIMIT on the chunked transfer path in http_response_recv_body(). Users should consult the FreeRDP GitHub Security Advisory GHSA-2c6r-4pr4-9x8m for the authoritative fix and the corresponding distribution updates for packaged builds.

Workarounds

Connect only to trusted RD Gateway endpoints operated by your organization or vetted providers
Enforce egress filtering so FreeRDP clients cannot reach arbitrary internet-facing RD Gateway hosts
Apply per-process memory limits (for example, ulimit -v or systemd MemoryMax=) to contain memory exhaustion of RDP client processes

bash

# Configuration example: constrain xfreerdp memory with systemd-run
systemd-run --scope --user -p MemoryMax=1G -p MemorySwapMax=0 \
    xfreerdp /g:gateway.example.com /v:host.internal /u:user