CVE-2026-73564

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b
https://github.com/fatedier/frp/pull/5428
https://github.com/fatedier/frp/releases/tag/v0.70.1
https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp
https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) frp es un proxy inverso rápido. Desde la versión 0.53.0 hasta la 0.70.1, la puerta de enlace de túnel SSH opcional de frp en pkg/ssh/server.go analiza una solicitud de canal de ejecución SSH sumando 4 a una longitud big-endian de cuatro bytes controlada por el atacante. Una longitud de 0xFFFFFFFF hace que la suma uint32 se desborde a 3, anula la verificación de límites de la carga útil y provoca que payload[4:3] entre en pánico en TunnelServer.handleNewChannel. Cuando no se configura ningún archivo authorized-keys, sshConfig.NoClientAuth permite que un par no autenticado alcance esta fase del canal antes de que se verifique el token de frp, por lo que una única solicitud de cinco bytes termina el proceso frps y cierra cada túnel activo. Este problema se solucionó en la versión 0.70.1.

Information

Published : 2026-08-13 18:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73564

Mitre link : CVE-2026-73564

CVE.ORG link : CVE-2026-73564

JSON object : View

Products Affected

No product.

CWE

CWE-129

Improper Validation of Array Index

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-73564", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73564", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:52:30.634352Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fatedier", "product": "frp", "versions": [{"status": "affected", "version": ">= 0.53.0, < 0.70.1"}]}]}], "published": "2026-08-13T18:18:18.950", "references": [{"url": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b", "source": "security-advisories@github.com"}, {"url": "https://github.com/fatedier/frp/pull/5428", "source": "security-advisories@github.com"}, {"url": "https://github.com/fatedier/frp/releases/tag/v0.70.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "source": "security-advisories@github.com"}, {"url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1."}, {"lang": "es", "value": "frp es un proxy inverso r\u00e1pido. Desde la versi\u00f3n 0.53.0 hasta la 0.70.1, la puerta de enlace de t\u00fanel SSH opcional de frp en pkg/ssh/server.go analiza una solicitud de canal de ejecuci\u00f3n SSH sumando 4 a una longitud big-endian de cuatro bytes controlada por el atacante. Una longitud de 0xFFFFFFFF hace que la suma uint32 se desborde a 3, anula la verificaci\u00f3n de l\u00edmites de la carga \u00fatil y provoca que payload[4:3] entre en p\u00e1nico en TunnelServer.handleNewChannel. Cuando no se configura ning\u00fan archivo authorized-keys, sshConfig.NoClientAuth permite que un par no autenticado alcance esta fase del canal antes de que se verifique el token de frp, por lo que una \u00fanica solicitud de cinco bytes termina el proceso frps y cierra cada t\u00fanel activo. Este problema se solucion\u00f3 en la versi\u00f3n 0.70.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}