Michael-Jread

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

**Name of the Vulnerable Software and Affected Versions** Netty (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.17.Final Netty (io.netty:netty-codec-http) versions prior to 4.1.138.Final **Description** An unbounded per-connection queue growth flaw exists in the `HttpServerCodec`. The codec tracks the HTTP method of unanswered pipelined requests; while the first 32 entries are bit-packed into a single long, subsequent entries are added to the `methodOverflowQueue` (an `ArrayDeque` with no size limit or rejection path). A remote, unauthenticated attacker can exploit this by pipelining HTTP/1.1 requests on a single connection and withholding reads to prevent responses from being flushed. This action allows the queue to grow without bound, leading to unbounded heap growth and a denial of service. **Recommendations** Update to version 4.2.18.Final. Update to version 4.1.138.Final.

**Name of the Vulnerable Software and Affected Versions** Netty STOMP codec versions prior to 4.1.138.Final Netty STOMP codec versions 4.2.0.Final through 4.2.17.Final **Description** A ByteBuf leak exists in the `StompSubframeDecoder` function. When a frame's declared content-length is fully read, the decoder allocates a chunk buffer and waits for the terminating NUL byte. If this byte is not received, the buffer is not released because the signal thrown by `skipNullCharacter()` extends Error instead of Exception, bypassing the release path. Additionally, the decoder does not override `handlerRemoved0` or `channelInactive`, allowing the buffer to persist after channel teardown. A remote peer can trigger this leak by sending a well-formed frame body without the terminating NUL byte, potentially leading to memory exhaustion as the pooled allocator does not reclaim the memory. **Recommendations** Update to version 4.1.138.Final or later. Update to version 4.2.18.Final or later.

**Name of the Vulnerable Software and Affected Versions** Netty versions 4.1.133.Final through 4.1.137.Final Netty versions 4.2.13.Final through 4.2.17.Final **Description** Improper validation of the final transfer coding in the `Transfer-Encoding` header allows attackers to perform request smuggling using malformed encoding declarations. This occurs when attackers split the `Transfer-Encoding` header across multiple lines or use values such as `chunked, xchunked` to bypass validation. Consequently, messages may be decoded as chunked even when the final coding is not chunked. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.