CVE-2026-110835 in FreeRDP
Summary
by MITRE • 10/15/2026
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical security flaw within the application's HTTP proxy implementation, specifically affecting how routing tokens are processed during connection establishment. This issue stems from an insufficient validation mechanism when handling input data destined for upstream proxies. Specifically, the software fails to reject or sanitize line feed characters embedded within the target portion of specific routing cookies, such as those associated with Microsoft Terminal Services (msts). When a remote unauthenticated RDP client connects to a proxy configured with FixedTarget set to false and utilizes an upstream HTTP proxy, this lack of sanitization allows maliciously crafted input to bypass standard filtering checks. The core technical failure lies in the http_proxy_connect function, which directly incorporates these unsanitized values into critical components of the HTTP communication protocol without performing adequate boundary validation.
From a technical perspective, the flaw enables HTTP header injection by allowing an attacker to inject line breaks that disrupt the structural integrity of HTTP requests and headers sent to the upstream proxy. In standard HTTP protocols, each header must be terminated with a carriage return followed by a line feed (CRLF). By injecting a lone LF character within the routing token, an attacker can effectively split what should be a single header value into multiple lines or introduce new header fields entirely. This manipulation alters the framing of the CONNECT request and the Host header, which are fundamental to establishing secure tunnels in RDP over HTTP scenarios. The ability to manipulate these headers allows for potential cache poisoning, session hijacking, or redirection attacks depending on how the upstream proxy interprets the malformed data.
The operational impact of this vulnerability is significant because it affects unauthenticated users who interact with FreeRDP clients configured as proxies. Since no authentication is required to exploit this flaw, any remote attacker capable of sending a crafted connection request can trigger the injection. This compromises the integrity and confidentiality of the communication channel between the client and the upstream proxy. Attackers could potentially redirect traffic to malicious endpoints, intercept sensitive data transmitted over the RDP session, or cause denial-of-service conditions by confusing the upstream proxy's parsing logic. The vulnerability highlights a broader class of issues related to improper input validation in network-facing applications that handle dynamic routing configurations.
This flaw aligns with CWE-74 Improper Neutralization of Special Elements used in an Output Document Used to Prevent XSS, although it specifically targets HTTP header injection rather than cross-site scripting. More accurately, it falls under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers, which describes vulnerabilities where applications fail to prevent attackers from injecting carriage return and line feed characters into headers. In terms of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with T1071 Application Layer Protocol, specifically web protocols like HTTP/HTTPS, allowing adversaries to manipulate traffic for malicious purposes such as data exfiltration or command and control channel manipulation.
To mitigate this risk, organizations utilizing FreeRDP must upgrade immediately to version 3.32.0 or later, where the input validation logic has been corrected to reject invalid characters in routing tokens. For environments that cannot yet patch, administrators should consider restricting proxy configurations to FixedTarget=true if feasible, thereby limiting dynamic target resolution and reducing the attack surface associated with variable header injection. Additionally, implementing strict output encoding on any user-supplied data passed through proxy layers can provide an additional layer of defense against CRLF injection attacks. Regular security audits focusing on input validation in network protocol implementations are recommended to identify similar weaknesses across other components of the infrastructure.