CVE-2026-110836
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.