Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-67289 EUVD-2026-51840GHSA-3x8f-6ffv-v2wc

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

Published Aug 1, 2026 · Updated Aug 5, 2026 · Assigned by VulnCheck

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.29.0 3.29.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.29.0+dfsg-1 —
Debian 13 freerdp3 No fix yet —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.26.04.1 —
Ubuntu 24.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 16.04 LTS freerdp No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 freerdp +5 2:3.10.3-12.el10_2.8 RHSA-2026:54486
RHEL 9 freerdp +4 2:2.11.7-7.el9_8.5 RHSA-2026:54487
RHEL 8 freerdp +4 2:2.11.7-11.el8_10 RHSA-2026:54485
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS freerdp +5 2:3.10.3-3.el10_0.11 RHSA-2026:58711
RHEL 9.6 EUS freerdp +4 2:2.11.7-1.el9_6.12 RHSA-2026:58713
RHEL 9.4 E4S freerdp +2 2:2.11.2-1.el9_4.10 RHSA-2026:58710
RHEL 9.2 E4S freerdp +2 2:2.4.1-6.el9_2.11 RHSA-2026:58712
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.10 RHSA-2026:61251
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.10 RHSA-2026:61251
RHEL 8.6 EUS Long Life freerdp +3 2:2.2.0-7.el8_6.11 RHSA-2026:61250
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.11 RHSA-2026:61250
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-14.el8_4.2 RHSA-2026:60173
RHEL 8.4 AUS freerdp +3 2:2.2.0-14.el8_4.2 RHSA-2026:60173
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.11 RHSA-2026:62401

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 freerdp +5 2:3.10.3-12.el10_2.8 ALSA-2026:54486
AlmaLinux 9 freerdp +4 2:2.11.7-7.el9_8.5 ALSA-2026:54487
AlmaLinux 8 freerdp +4 2:2.11.7-11.el8_10 ALSA-2026:54485

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 freerdp 2:3.10.3-12.el10_2.8 RLSA-2026:54486
Rocky Linux 9 freerdp 2:2.11.7-7.el9_8.5 RLSA-2026:54487
Rocky Linux 8 freerdp 2:2.11.7-11.el8_10 RLSA-2026:54485

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.6.3-1.amzn2023.0.15 ALAS2023-2026-2111
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.14 ALAS2-2026-3887

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 freerdp +5 2:3.10.3-12.el10_2.8 ELSA-2026-54486
Oracle Linux 9 freerdp +4 2:2.11.7-7.el9_8.5 ELSA-2026-54487
Oracle Linux 8 freerdp +4 2:2.11.7-11.el8_10 ELSA-2026-54485

Advisories 23

References