Log in Start free

Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67289FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

Critical 9.8

In plain English

A critical-severity security flaw in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 62.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:8freerdp2:2.11.7-11.el8_10ALSA-2026:54485
AlmaLinux:9freerdp2:2.11.7-7.el9_8.5ALSA-2026:54487
AlmaLinux:10freerdp-devel2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:8freerdp-devel2:2.11.7-11.el8_10ALSA-2026:54485
AlmaLinux:9freerdp-devel2:2.11.7-7.el9_8.5ALSA-2026:54487
AlmaLinux:10freerdp-libs2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:8freerdp-libs2:2.11.7-11.el8_10ALSA-2026:54485
AlmaLinux:9freerdp-libs2:2.11.7-7.el9_8.5ALSA-2026:54487
AlmaLinux:10freerdp-server2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:10libwinpr2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:8libwinpr2:2.11.7-11.el8_10ALSA-2026:54485
AlmaLinux:9libwinpr2:2.11.7-7.el9_8.5ALSA-2026:54487
AlmaLinux:10libwinpr-devel2:3.10.3-12.el10_2.8ALSA-2026:54486
AlmaLinux:8libwinpr-devel2:2.11.7-11.el8_10ALSA-2026:54485
AlmaLinux:9libwinpr-devel2:2.11.7-7.el9_8.5ALSA-2026:54487
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-67289
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-67289
Debian:14freerdp33.29.0+dfsg-1DEBIAN-CVE-2026-67289
Rocky Linux:10freerdp2:3.10.3-12.el10_2.8RLSA-2026:54486
Rocky Linux:8freerdp2:2.11.7-11.el8_10RLSA-2026:54485
Rocky Linux:9freerdp2:2.11.7-7.el9_8.5RLSA-2026:54487
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-67289
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-67289
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-67289

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 0 – before 3.29.0

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References