CVE-2026-110835 FreeRDP CVE debrief

Who should care

Defenders responsible for RDP and proxy configurations, security teams monitoring for suspicious activity, and administrators of FreeRDP instances should be aware of this vulnerability and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-110835 is a MEDIUM-severity vulnerability in FreeRDP that allows for HTTP header injection via a proxy routing token. Defenders should prioritize verifying exposure, assessing configurations, and monitoring for suspicious activity to prevent potential security issues.

• Potential for HTTP header injection attacks
• Exposure of FreeRDP instances to unauthenticated RDP clients
• Alteration of HTTP request/header framing at the upstream proxy
• Verification of FreeRDP configurations and proxy settings

Technical summary

The vulnerability is caused by the lack of rejection of a lone LF in the target portion of a routing token (Cookie: msts=) in FreeRDP's proxy implementation. This allows an attacker to alter HTTP request/header framing at the upstream proxy, potentially leading to security issues. FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.

Defensive priority

Defenders should prioritize verifying exposure of FreeRDP instances, especially those using FixedTarget=false and an upstream HTTP proxy, and assess the potential for HTTP header injection attacks.

Recommended defensive actions

• Verify FreeRDP instances using FixedTarget=false and an upstream HTTP proxy for potential exposure
• Assess the configuration of FreeRDP to prevent HTTP header injection attacks
• Monitor for suspicious activity related to RDP connections and HTTP proxy usage
• Update FreeRDP to version 3.32.0 or later to patch the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the lack of rejection of a lone LF in the target portion of a routing token (Cookie: msts=) in FreeRDP's proxy implementation. This allows an attacker to alter HTTP request/header framing at the upstream proxy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.