CVE-2026-67289
Received Received - Intake

HTTP Proxy Injection in FreeRDP via CRLF in Redirection

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67289
EUVD
EUVD-2026-51840

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a vulnerability where it fails to validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This field is copied into the client's ServerHostname and, when connecting through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header without filtering. A malicious or compromised RDP server can exploit this to inject arbitrary headers or requests into the HTTP proxy CONNECT request.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual HTTP proxy CONNECT requests containing control characters or CRLF sequences in the TargetNetAddress field. Inspect proxy logs for malformed Host headers or CONNECT requests with embedded line breaks or control characters. Use network traffic analysis tools like tcpdump or Wireshark to capture and inspect RDP redirection PDUs for malicious payloads.

Impact Analysis

This vulnerability allows a malicious or compromised RDP server to inject arbitrary headers or requests into the HTTP proxy CONNECT request. This could lead to unauthorized access, data exfiltration, or further attacks on systems using the proxy. Users of FreeRDP versions 3.28.0 and earlier are at risk if they connect through an HTTP proxy.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected FreeRDP versions may face legal and financial penalties due to potential data exposure or unauthorized system access.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later to address the vulnerability. If upgrading is not immediately possible, disable HTTP proxy support in FreeRDP clients or restrict proxy usage to trusted servers. Monitor network traffic for signs of exploitation and apply network-level controls to block malformed HTTP requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart