CVE-2026-110835

Undergoing Analysis Undergoing Analysis - In Progress

FreeRDP Proxy HTTP Header Injection Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: VulnCheck

Description

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110835

EUVD

EUVD-2026-101718

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

FreeRDP 3.0.0 before 3.32.0 has a vulnerability where a lone LF (line feed) in the target portion of a routing token (Cookie: msts=) is not rejected. This allows an unauthenticated remote RDP client to inject HTTP headers when connecting through a proxy with FixedTarget=false and an upstream HTTP proxy. The injected LF alters the CONNECT request line and Host header, enabling HTTP request/header framing manipulation at the upstream proxy.

Detection Guidance

Detecting this vulnerability requires monitoring for HTTP header injection attempts in FreeRDP proxy connections. Check FreeRDP logs for malformed routing tokens with lone LF characters in the target portion of the msts cookie. Inspect HTTP proxy logs for CONNECT requests with unusual header framing or Host headers. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to alter HTTP requests or headers sent through the proxy, potentially leading to unauthorized access, data interception, or manipulation of sensitive information. This could affect confidentiality and integrity of communications for users relying on the proxy.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's confidentiality and integrity requirements or HIPAA's safeguards for protected health information. Organizations using affected FreeRDP versions may fail compliance audits if exploited.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to address the HTTP header injection issue in the proxy component.

Hi! I’m here to help you understand CVE-2026-110835. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70