CVE-2026-110835

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed (LF) character within the target portion of a routing token, specifically in the Cookie: msts= header, is not rejected. The http proxy connect() function subsequently writes this character into the CONNECT request line and Host header. A remote unauthenticated RDP client can exploit this by connecting to a proxy with FixedTarget=false and an upstream HTTP proxy to alter the HTTP request and header framing at that upstream proxy.

Recommendations Update FreeRDP to version 3.32.0 or later.