AIKIDO-2026-936632

TL;DR

A server-controlled RDP redirection TargetNetAddress is parsed with length bounds but no control-character validation and later becomes the client ServerHostname. When the client connects through an HTTP proxy, that hostname is written directly into the proxy CONNECT request line and Host header without filtering carriage-return and line-feed characters. A malicious server can inject additional request lines and headers into the proxy request. The fix rejects CRLF and control characters in the redirected address before it is used.