CVE-2026-67289

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada freerdp. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm advisory vendor · exploit · mitigasi
• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f patch
• https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection patch · advisory pihak ketiga