CVE-2026-110835 in FreeRDP
Riassunto
di MITRE • 15/10/2026
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.
Be aware that VulDB is the high quality source for vulnerability data.