Bug 2565875 (CVE-2026-121399)
| Summary: | CVE-2026-121399 freerdp: FreeRDP: Denial of service via excessive memory allocation in RD Gateway packet handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. A malicious Remote Desktop (RD) Gateway server can trigger a Denial of Service (DoS) by sending a specially crafted packet header with an excessively large declared length prior to authentication. This causes the client to allocate an excessive amount of system memory, leading to memory exhaustion and application unresponsiveness.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565985, 2565987 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-03 15:20:18 UTC
|