crítica
CVE-2026-91949
freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
Red Hat9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat, AlmaLinux, Oracle, Rocky Linux. Más baja según Amazon (alta), Ubuntu (media).
Descripción
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | freerdp, freerdp-devel, freerdp-libs y 3 más | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp, freerdp-libs, libwinpr | 2:3.10.3-12.el10_2.13 |
| amazon linux 2023 | freerdp, freerdp-debuginfo, freerdp-debugsource y 8 más | 2:3.31.0-1.amzn2023 |
| debian 13 | freerdp3 | sin corrección indicada |
| debian 14 | freerdp3 | 3.31.0+dfsg-1 |
| echo | freerdp3 | sin corrección indicada |
| rapidfort alma 10 | freerdp, freerdp-devel, freerdp-libs y 3 más | 2:3.10.3-12.el10_2.13 |
| rapidfort alpine 3.20 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.31.0-r0 |
Mostrar las 56 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| alma 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| alma 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rocky 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| amazon linux 2023 | freerdp | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-debugsource | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-devel | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-libs | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-libs-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-server | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-server-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr-devel | 2:3.31.0-1.amzn2023 |
| debian 13 | freerdp3 | sin corrección indicada |
| debian 14 | freerdp3 | 3.31.0+dfsg-1 |
| echo | freerdp3 | sin corrección indicada |
| rapidfort alma 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort alpine 3.20 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.31.0-r0 |
| rapidfort amazon linux 2023 | freerdp | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-devel | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-libs | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-server | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | libwinpr | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | libwinpr-devel | 2:3.31.0-1.amzn2023 |
| rapidfort debian 12 | freerdp3 | 0:3.31.0+dfsg-1 |
| rapidfort debian 13 | freerdp3 | 0:3.31.0+dfsg-1 |
| rapidfort fedora 43 | freerdp | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-devel | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-libs | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-server | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | libwinpr | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | libwinpr-devel | 2:3.31.0-1.fc43 |
| rapidfort Oracle Linux 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| ubuntu 24.04 | freerdp3 | 3.31.0+dfsg-0ubuntu0.24.04.1 |
| ubuntu 26.04 | freerdp3 | 3.31.0+dfsg-0ubuntu0.26.04.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:73979
- https://access.redhat.com/security/cve/CVE-2026-91949
- https://bugzilla.redhat.com/2533925
- https://bugzilla.redhat.com/show_bug.cgi?id=2533925
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91949
- https://errata.almalinux.org/10/ALSA-2026-73979.html
- https://errata.rockylinux.org/RLSA-2026:73979
Las 15 referencias
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
- https://linux.oracle.com/cve/CVE-2026-91949.html
- https://linux.oracle.com/errata/ELSA-2026-73979.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-91949
- https://www.cve.org/CVERecord?id=CVE-2026-91949
- https://www.openwall.com/lists/oss-security/2026/09/01/2
- https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass