{"id":"CVE-2026-73564","title":"frp is a fast reverse proxy","summary":"frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF ma…","severity":"high","cwe":["CWE-129","CWE-190"],"vendor":"fatedier","product":"github.com/fatedier/frp","affected":["github.com/fatedier/frp >= 0.53.0, < 0.70.1"],"patched":["github.com/fatedier/frp 0.70.1"],"published":"2026-08-13","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73564","references":[{"url":"https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b","label":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/pull/5428","label":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/releases/tag/v0.70.1","label":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp","label":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/fatedier/frp"}],"tags":["nvd","osv","go"],"epss":0.00487,"epssPercentile":0.41042,"aliases":["GHSA-26gq-p25f-99cp"],"ecosystem":"go","ingestedAt":"2026-08-13T19:18:20.918Z","slug":"CVE-2026-73564","body":"## Overview\n\nfrp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73564)\n\nAffected packages:\n\n- `github.com/fatedier/frp >= 0.53.0, < 0.70.1`\n\nPatched in:\n\n- `github.com/fatedier/frp 0.70.1`\n\nSource: https://osv.dev/vulnerability/GHSA-26gq-p25f-99cp","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}