CVE-2026-110836

Executive Summary

CVE-2026-110836 is an infinite loop vulnerability in FreeRDP versions 3.0.0 through 3.31.x, triggered inside the http_response_recv() function when a malicious RDP gateway returns a nonzero Content-Length alongside a semicolon-containing, unrecognized Content-Type header. A gateway that is under attacker control can pin a FreeRDP client thread at full CPU utilization indefinitely, degrading or disabling the affected client endpoint. Exploitation requires user interaction (a victim must connect through the malicious gateway) and results in a high availability impact only, with no confidentiality or integrity loss.

Technical Analysis

The vulnerability is classified as CWE-835: Loop with Unreachable Exit Condition ("Infinite Loop"). The flaw resides in FreeRDP's HTTP response handling logic, specifically the http_response_recv() routine used when the client communicates with an RDP gateway (the RDP-over-HTTP transport path). According to the NVD description, the trigger condition combines three elements originating from a gateway response:

1. A nonzero Content-Length header, signaling that a response body of a defined size is expected.
2. A Content-Type header containing a semicolon, such as a parameterized media type containing parameters (for example a type with attached parameters).
3. The Content-Type value being unrecognized by the client's parser.

When these conditions are met, the client's receive loop fails to reach a terminating condition — the loop cannot exit — and the processing thread spins at full CPU indefinitely. The precise parsing branch that causes the loop is not enumerated in the available description, so the exact comparison or pointer-advance logic that stalls cannot be stated with certainty. What is technically derivable is the mechanism class: a header-parsing state machine enters a state in which the input stream position is never advanced or the expected termination token is never matched, so the loop condition remains true forever.

The attack surface is the client-side HTTP response parser in FreeRDP 3.0.0 and later, reached when a user initiates a connection to a remote desktop endpoint that routes through an HTTP(S) gateway. Because FreeRDP acts as the client in this flow, the vulnerable component is the endpoint software installed on user workstations or jump hosts, not a server-side daemon. The semicolon in Content-Type is significant because parameterized Content-Type values conventionally use the semicolon as a parameter separator; a naive parser that does not correctly strip parameters before matching against a known-type table can enter a non-progressing branch. The available description does not identify the exact code path beyond http_response_recv(), and no source-level patch diff is available to confirm the fix.

The availability-only impact (C:N/I:N/A:H) is consistent with a CPU-exhaustion loop: no memory corruption, no data exposure, and no write primitive are described. This distinguishes the CVE from memory-safety issues in the same protocol stack and constrains the realistic threat to denial of service on the client.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-110836. The attack chain below is described at the vulnerability-class level, using only the function name and header fields explicitly documented in the NVD description.

1. Reconnaissance and positioning. The attacker must control, compromise, or impersonate an RDP gateway that a victim's FreeRDP client will connect through. Positioning options at the class level include: operating a rogue gateway and luring users to it, compromising a legitimate gateway, or performing a man-in-the-middle position on the gateway path (subject to TLS constraints in real deployments). No authentication on the gateway HTTP response is implied by the vector (PR:N).

2. Triggering the flaw. When the victim initiates a connection, the attacker-controlled gateway returns an HTTP response crafted to satisfy the three documented conditions simultaneously: a nonzero Content-Length, and a Content-Type header that both contains a semicolon and is not a type the client recognizes. Because the parser fails to make forward progress on this combination inside http_response_recv(), the client thread enters an infinite loop.

3. Payload/execution method. No buffer overflow, code injection, or shellcode is involved. The "payload" is the malformed HTTP response header itself; the exploitation primitive is the parser state condition, not executable content. The attacker does not need to deliver a file or exploit a memory-safety bug — only to shape the response headers.

4. Post-exploitation impact. The affected client thread consumes CPU indefinitely. Depending on how the FreeRDP process is structured, this can render the client session unusable and consume enough CPU to degrade the host. The NVD description specifies impact to the client only: no code execution, data theft, or lateral movement is described.

Note: No public PoC is available; the attack chain above is inferred from the vulnerability class (CWE-835) and the documented trigger conditions. The requirement for user interaction (UI:R) means the attacker cannot trigger the loop without a victim connecting to the attacker-influenced gateway.

Impact Assessment

The CVSS v3.1 base score is 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Decomposition of the subscores:

• AV:N (Network): the malicious response is delivered over the network path between client and gateway.
• AC:L (Low): no special conditions beyond the crafted headers are required; the documented trigger is deterministic.
• PR:N (None): the attacker does not need gateway authentication credentials in the described scenario.
• UI:R (Required): the victim must initiate a connection through the malicious gateway; there is no zero-interaction vector.
• S:U (Unchanged): the impact is confined to the vulnerable FreeRDP client component.
• C:N / I:N: no confidentiality or integrity impact is described.
• A:H (High): CPU exhaustion from an unexitable loop constitutes a high availability impact on the affected client thread and potentially the host.

Blast radius. Any organization whose users run affected FreeRDP client versions (3.0.0 through 3.31.x) and connect to RDP endpoints through HTTP gateways is in scope. Because the vulnerable component is a client library, exposure depends on user connection behavior rather than on internet-facing services, which limits mass-scan exploitation but does not eliminate targeted abuse. The UI:R requirement means an attacker generally needs to influence gateway selection (rogue gateway, DNS/routing manipulation, or gateway compromise) rather than exploit the flaw opportunistically at internet scale. Business impact centers on workstation or jump-host availability: a single stuck thread can freeze a remote session mid-task, and multiple affected users connecting through the same malicious or compromised gateway could produce a wave of unresponsive endpoints. EPSS has not yet been scored by FIRST.org, so no probabilistic exploitation-likelihood figure is available; no CISA KEV listing exists; and there is no evidence of in-the-wild exploitation in the provided intelligence.

Detection Guidance

Sigma Rule

title: FreeRDP Client HTTP Response Infinite Loop via Malicious Gateway Headers
id: 7c1e9a44-2b0d-4f6a-9d3e-1a5c8b7f0e21
status: experimental
description: Detects FreeRDP client processes exhibiting sustained high CPU consistent with the http_response_recv() infinite loop triggered by crafted Content-Type and Content-Length headers from a malicious gateway (CVE-2026-110836).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110836
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wfreerdp.exe'
      - '\xfreerdp.exe'
      - '\freerdp.exe'
  selection_cmdline:
    CommandLine|contains:
      - '/gateway:'
      - '/g:'
  condition: selection_img and selection_cmdline
fields:
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate gateway usage against trusted infrastructure
level: medium

This rule flags FreeRDP client launches that route through a gateway, which is the precondition for reaching the vulnerable http_response_recv() code path. It is a targeting aid, not a positive exploitation signature; correlate with endpoint CPU telemetry to confirm a pinned thread.

YARA Rule

rule CVE_2026_110836_FreeRDP_Gateway_Headers
{
    meta:
        description = "Detects HTTP gateway responses containing the malformed Content-Type and Content-Length combination associated with the FreeRDP http_response_recv() infinite loop (CVE-2026-110836)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110836"
        cve = "CVE-2026-110836"

    strings:
        $cl = "Content-Length:" ascii nocase
        $ct = "Content-Type:" ascii nocase
        $semi = ";" ascii

    condition:
        filesize < 8KB and
        #cl > 0 and #ct > 0 and #semi > 0
}

This is a heuristic file/stream matcher for captured gateway response artifacts. It intentionally avoids fixed manufacturer strings because none are documented; it keys on the co-occurrence of the two headers with a semicolon, which is the documented trigger shape. Tune against legitimate parameterized Content-Type traffic (e.g., multipart boundaries) to reduce noise.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110836 FreeRDP Gateway Crafted Content-Type Infinite Loop Attempt"; flow:established,to_client; http.header_names; content:"Content-Length"; http.header_names; content:"Content-Type"; http.header; content:"Content-Type|3a|"; fast_pattern; content:";"; http.header; pcre:"/Content-Type\x3a[^\r\n]*;/Hi"; content:"Content-Length|3a|"; http.header; pcre:"/Content-Length\x3a\s*[1-9]/Hi"; classtype:attempted-dos; reference:cve,2026-110836; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110836; sid:2026110836; rev:1;)

This rule fires on HTTP responses flowing server-to-client that pair a nonzero Content-Length with a semicolon-bearing Content-Type, mirroring the documented trigger. Expect false positives from legitimate parameterized content types (multipart, charset parameters); deploy initially in alert-only mode and baseline.

Elastic Detection

process where process.name in ("xfreerdp", "wfreerdp", "FreeRDP", "freerdp") and
  process.command_line != null and
  (process.command_line like~ "*/gateway:*" or process.command_line like~ "*/g:*")

This EQL query identifies FreeRDP client processes initiated with gateway transport, the required precondition for the vulnerable HTTP parsing path. Pair it with host CPU anomaly detection keyed on the same process to surface the infinite-loop condition described by CVE-2026-110836.

Splunk SPL Query

index=endpoint (process_name="xfreerdp" OR process_name="wfreerdp" OR process_name="freerdp.exe")
    (process_command_line="*/gateway:*" OR process_command_line="*/g:*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, process_command_line
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - last_seen

Correlate results with CPU telemetry (e.g., index=perfmon counter="% Processor Time") for the same host and process to distinguish a benign gateway connection from a pinned thread. This query supports triage rather than direct exploitation confirmation.

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-110836,">
  <rule id="2026110" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">\.(xfreerdp|wfreerdp|freerdp)$</field>
    <field name="process.command_line">/gateway:|/g:</field>
    <description>CVE-2026-110836: FreeRDP client launched via gateway transport - potential malicious gateway infinite-loop exposure</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

This rule generates an alert when FreeRDP is invoked with gateway arguments on a monitored endpoint, enabling correlation with subsequent CPU saturation. It is a precondition indicator, not proof of exploitation.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Avoid connecting affected FreeRDP clients through untrusted, unverified, or user-supplied gateways; restrict gateway configuration to known-good organizational infrastructure.
   • Where FreeRDP gateway usage is not operationally required, disable or block /gateway:-based connection profiles at the endpoint configuration and policy level.
   • Monitor FreeRDP client processes for abnormal sustained CPU consumption; terminate and investigate pinned processes.
   • Enforce TLS validation for gateway connections and restrict gateway endpoints via egress filtering to reduce rogue/machine-in-the-middle gateway placement opportunities.

2. Patch/upgrade steps.

   • The NVD description identifies 3.32.0 as the version boundary (affected: 3.0.0 before 3.32.0). Treat 3.32.0 as the presumed fixed release, but because patch confidence is 0/4 and no vendor advisory, commit, or patch artifact is available in the provided intelligence, do not assume remediation without independently verifying the fix against the vendor's release notes.
   • Inventory all systems running FreeRDP 3.0.0 through 3.31.x and plan staged upgrades once a confirmed fix is available. Re-test gateway connectivity after upgrade.

3. Long-term hardening.

   • Track FreeRDP security advisories and release notes directly from the project; subscribe to the CVE record for updates.
   • Apply least-privilege and network segmentation so that gateway egress is limited to approved destinations.
   • Enforce client-side resource controls (process CPU watchdogs, session timeouts) to bound the impact of unexitable-loop denial-of-service classes.
   • Where feasible, prefer connecting through gateways protected by mutual TLS and organizational certificate pinning to frustrate rogue-gateway positioning.

References

• NVD — CVE-2026-110836: https://nvd.nist.gov/vuln/detail/CVE-2026-110836
• CWE-835 — Loop with Unreachable Exit Condition ("Infinite Loop"): https://cwe.mitre.org/data/definitions/835.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FreeRDP project repository and release notes (verify 3.32.0 fix status): https://github.com/FreeRDP/FreeRDP
• FIRST.org EPSS (not yet scored for this CVE at time of writing): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided intelligence. CISA KEV status is NO. No public PoC, exploit code, or Nuclei template is available.