The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-libs | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | No solution exists | Aug 4, 2026 | Aug 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub