Threats tagged 'ghsa-8rqh-cpfg-mwcc'

FreeRDP versions prior to 3.32.2 have an infinite loop vulnerability in the websocket_context_read function. This flaw occurs because the function does not properly handle a zero BIO result when there is still payload data outstanding. An attacker controlling an RD Gateway can exploit this by sending a truncated WebSocket frame followed by a TLS close_notify, causing the client thread to enter a CPU-consuming infinite loop until terminated.