CVE-2026-110836

Undergoing Analysis Undergoing Analysis - In Progress

Infinite Loop in FreeRDP via Malicious Gateway Content-Type

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110836

EUVD

EUVD-2026-101719

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

FreeRDP versions from 3.0.0 to 3.32.0 have an infinite loop flaw in the http_response_recv() function. Attackers controlling a gateway can send a crafted Content-Type header with a semicolon and nonzero Content-Length, causing the client to enter an endless CPU-consuming loop.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal CPU usage by FreeRDP clients or suspicious Content-Type headers in network traffic. Check running processes for FreeRDP with high CPU usage and inspect HTTP responses from gateways for semicolon-containing Content-Type headers.

Impact Analysis

If you use FreeRDP in a vulnerable version, an attacker controlling a gateway could make your system consume 100% CPU indefinitely, leading to denial of service and system unresponsiveness.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates ensuring access to protected health information. CPU exhaustion from this flaw may lead to service unavailability, violating these requirements.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to address the infinite loop issue.
Block or monitor untrusted gateways that may send malicious Content-Type headers.
Restrict network access to FreeRDP clients to prevent unauthorized gateway interactions.

Hi! I’m here to help you understand CVE-2026-110836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70