CVE-2026-110835: FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using FreeRDP versions from 3.0.0 before 3.32.0 are exposed when the proxy is configured with FixedTarget=false and uses an upstream HTTP proxy. The vulnerable path is reached by an RDP client supplying a routing token in the msts cookie.
Does an attacker need credentials or user interaction to exploit it?
No. A remote unauthenticated RDP client can exploit the issue by connecting to the affected proxy and providing a routing token containing a lone LF in its target portion.
What is the impact at the upstream proxy?
The injected LF can alter HTTP request and header framing because the routing-token target is written into the upstream CONNECT request line and Host header. The reported impact is integrity-related; no confidentiality or availability impact is specified.
What configuration change can reduce exposure if upgrading is not immediately possible?
Avoid the affected proxy routing configuration: do not combine FixedTarget=false with an upstream HTTP proxy. This removes the deployment condition described for exploitation.