CVE-2026-121959FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

Açıklama

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-x26g-fp9v-c2pg) vendor-advisoryExploitMitigationVendor Advisory
• VulnCheck Advisory: FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame third-party-advisoryThird Party Advisory