🚨Critical - Two FreeRDP client flaws: TLS cert-validation bypass and HTTP proxy request injection (CVE-2026-66402 & CVE-2026-67289) Both affect FreeRDP <= 3.28.0 and are fixed in 3.29.0. CVE-2026-66402 (CWE-295): FreeRDP does custom CN/DNS-SAN matching instead of OpenSSL's length-aware APIs, so it truncates DNS SANs at embedded NUL bytes, accepts a matching Common Name even when non-matching SANs are present, and accepts IP-literal targets without checking iPAddress SANs. An attacker who can present a trusted or misissued certificate can bypass server identity verification and MitM the RDP session. CVE-2026-67289 (CWE-113): FreeRDP doesn't validate CRLF/control chars in the server-controlled RDP redirection TargetNetAddress. When the client connects through an HTTP proxy, that value is written unfiltered into the proxy CONNECT line and Host header, letting a malicious server inject arbitrary requests/headers into the proxy connection. Both are client-side MitM-class bugs, CVSS 9.8. FreeRDP underpins many remote-desktop tools, so the footprint is broad. 👉Upgrade FreeRDP to 3.29.0 (also fixes the clipboard RCE CVE-2026-67305).
Post summary
Two new critical FreeRDP client flaws (TLS cert‑validation bypass and HTTP proxy request injection) are disclosed, with detailed technical info and a fix available in version 3.29.0.