FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfo | Sep 30, 2026 | Sep 15, 2026 |
| Redhat_linux | — | Upgrade libwinpr-develUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs | Oct 5, 2026 | Sep 15, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-serverUpgrade freerdp-libs-debuginfo | Oct 5, 2026 | Oct 2, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Sep 22, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub