This CVE describes a resource exhaustion vulnerability in FreeRDP's HTTP response handling that allows a compromised or man-in-the-middle RD Gateway to exhaust client-side memory. The vulnerability lives in the chunked transfer encoding decoder within http_response_recv_body(), which processes HTTP responses without respecting the RESPONSE_SIZE_LIMIT boundary that other response parsing paths enforce. When a Gateway sends chunked responses to a connected client, the size limit is bypassed entirely, allowing unbounded memory allocation.
The exploit path requires a compromised RD Gateway rather than direct internet exposure, which explains the low EPSS score (0.00343). However, this scoring methodology likely understates enterprise risk. In typical RDP deployments, the Gateway sits inside the perimeter with authenticated user traffic flowing through it. Compromising the Gateway is often a realistic threat objective in itself — it provides persistent, authenticated relay capacity without requiring the client to do anything unusual. The attacker sends chunked responses normally and the client exhausts memory. No additional client interaction is needed.
Remediation is straightforward: update FreeRDP to version 3.29.0. However, the deeper concern is architectural. RESPONSE_SIZE_LIMIT exists as a scattered conditional check in specific parsing functions rather than as an enforced invariant of the HTTP response handling subsystem. This means other response handlers likely have equivalent enforcement gaps. The patch fixes this instance but doesn't close the vulnerability class. You should request a systematic audit of all HTTP response parsing paths for similar size limit bypasses, particularly in WebSocket upgrade handlers, SSE streams, or other non-standard response types that may have been added more recently.