HTTP Header Injection Vulnerability in FreeRDP Proxy Functionality
CVE-2026-110835

6.3MEDIUM

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110835?

A vulnerability in FreeRDP's proxy mechanism allows for HTTP header injection due to improper handling of routing tokens in connect requests. Specifically, the proxy fails to reject a lone line feed (LF), which can be injected by an unauthenticated RDP client. When using FixedTarget=false and connecting through an upstream HTTP proxy, this flaw enables a remote attacker to manipulate HTTP request framing. This could lead to malicious activities, including session hijacking or redirecting the user to a different destination. Users of FreeRDP versions before 3.32.0 should review their configurations and consider implementing necessary mitigations.

Affected Version(s)

FreeRDP 3.0.0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
skigeek16
opensec-intelligence
.