FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
CVSS Details
- CVSS 4.0 Base Score: 9.3 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdpUpgrade libwinpr | Oct 11, 2026 | Aug 13, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-devel | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfo | Sep 1, 2026 | Aug 1, 2026 |
| Oracle_linux | — | Upgrade freerdpUpgrade freerdp-develUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-server | Oct 22, 2026 | Aug 1, 2026 |
| Redhat_linux | — | No solution existsUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade libwinpr-debuginfo | Aug 12, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub