Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-121959: FreeRDP can be forced to waste CPU
CVE-2026-121959 · published today
Summary
Versions of FreeRDP earlier than 3.32.2 may get stuck in a loop when they receive a malformed WebSocket frame from a remote gateway. This can cause the client program to use a lot of processor power until it is stopped. Updating FreeRDP to the latest release (or applying the supplied patch) resolves the issue.
What to do
- Update debian freerdp3 to version 3.32.2+dfsg-1.
- Update freerdp freerdp to version 3.32.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | freerdp | freerdp | < 3.32.2 |
| Debian:12 | debian | freerdp2 | All versions |
| Debian:13 | debian | freerdp3 | All versions |
| Debian:14 | debian | freerdp3 |
< 3.32.2+dfsg-1 Fix: upgrade to 3.32.2+dfsg-1
|
Original advisory text
DEBIAN-CVE-2026-121959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta