CVE-2026-67289
Freerdp ≤ 3.29.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-67289 is a critical-severity HTTP Request/Response Splitting (CWE-113) vulnerability in Freerdp Freerdp. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-51840
Vulnerability Data
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written…
more
directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.2V4.1.3V1.3.6V4.2.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation stops unneutralized CR/LF characters from being accepted and later emitted in HTTP headers.
Output filtering can neutralize CRLF sequences before they reach HTTP response headers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input sanitization and header handling that prevent CRLF injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach HTTP header sanitization and therefore stop most (but not all) instances of CRLF injection from reaching production; a bounded remainder exists in implementation gaps, outsourced development without full assurance, and post-deployment changes.
A.8.26 explicitly lists resilience against SQL injections and input validation as application security requirements (items d and j), which directly addresses improper neutralization of special sequences like CRLF in HTTP headers; however, this is only one slice of a broad requirements-identification control whose coverage of other injection vectors, output handling, and non-web contexts leaves a bounded remainder.
A.8.27 mandates security-by-design principles (including input distrust, data validation/sanitization, secure architecture layers, and design reviews against attack patterns) that reach HTTP header sanitization and would stop most CRLF splitting if applied; this is a minority slice of the weakness because the clause is a general process that depends on specific implementation rigor and does not itself neutralize sequences in every code path or library.
Secure coding standards require neutralization of CRLF sequences before inclusion in HTTP headers.