CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the configured RESPONSE_SIZE_LIMIT when reading HTTP responses that use Transfer-Encoding: chunked in http_response_recv_body(), so an oversized chunked body is accepted without any effective cap. An attacker controlling a malicious or compromised Remote Desktop Gateway endpoint can feed a connecting FreeRDP client an effectively unlimited response body, exhausting client memory and causing a crash or hang; the CVSS 4.0 score of 8.7 reflects high availability impact only, with no confidentiality or integrity impact. Any user or application that uses FreeRDP (the xfreerdp client and embedders such as Remmina, Apache Guacamole, and thin-client vendors) to connect through an RD Gateway is affected. No in-the-wild exploitation is known: the flaw is absent from CISA KEV, EPSS is a low 0.3% (27th percentile), and the only public reference is the vendor's GitHub security advisory. The flaw is fixed in FreeRDP 3.29.0.

What to do: Upgrade to FreeRDP 3.29.0 or later and rebuild or repackage dependent applications (e.g., Remmina, Apache Guacamole) against the patched library. Until patched, restrict RDP-over-Gateway connections to trusted, known RD Gateways, keep gateway TLS certificate validation enabled, and monitor FreeRDP-based client processes for abnormal memory growth.