CVE-2026-110835

A flaw was found in FreeRDP. A remote, unauthenticated attacker can perform HTTP header injection by submitting a routing token containing an unvalidated line feed character to a FreeRDP proxy configured with dynamic targets and an upstream Hypertext Transfer Protocol (HTTP) proxy. This vulnerability allows the attacker to alter HTTP request framing and inject custom headers into outbound proxy requests, potentially compromising the integrity of communications handled by the upstream proxy.

This flaw is rated Moderate because HTTP header injection via a crafted proxy routing token has limited integrity impact (I:L) under non-trivial conditions (AC:H). Restrict freerdp-proxy exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not expose freerdp-proxy to untrusted clients. Validate/normalize routing tokens and apply CRLF sanitization. Restrict proxy access.