FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress fiel…

FreeRDP versions 3.28.0 and earlier are vulnerable to HTTP proxy request injection due to insufficient validation of the server-controlled RDP redirection TargetNetAddress field. The field is not sanitized for CRLF or control characters before being written into HTTP proxy CONNECT requests and Host headers. A malicious or compromised RDP server can exploit this by sending a crafted redirection PDU with embedded control characters, allowing arbitrary header and request injection into the HTTP proxy CONNECT stream. This could enable traffic hijacking, cache poisoning, or other proxy-level attacks. The vulnerability is fixed in FreeRDP 3.29.0. A GitHub commit and security advisory are available detailing the patch. Users connecting through HTTP proxies are most at risk. The issue is tracked under GHSA-mwwh-mhp9-q7vm and documented by VulnCheck.