HTTP proxy CONNECT injection in FreeRDP via RDP redirection TargetNetAddress (CVE-2026-67289)

FreeRDP does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and written directly into the HTTP proxy CONNECT request line and Host header without filtering, allowing a malicious or compromised RDP server to inject arbitrary headers or requests into the proxy connection. Exploitation requires the client to use an HTTP proxy and the RDP server to send a crafted redirection PDU. Affected versions: - <= 3.28.0 We recommend updating to: 3.29.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm Details: https://vuln.today/cve/CVE-2026-67289