---
id: CVE-2026-73564
title: frp is a fast reverse proxy
summary: >-
  frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH
  Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by
  adding 4 to an attacker-controlled four-byte big-endian length. A length of
  0xFFFFFFFF ma…
severity: high
cwe:
  - CWE-129
  - CWE-190
vendor: fatedier
product: github.com/fatedier/frp
affected:
  - 'github.com/fatedier/frp >= 0.53.0, < 0.70.1'
patched:
  - github.com/fatedier/frp 0.70.1
published: '2026-08-13'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73564'
references:
  - url: >-
      https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b
    label: security-advisories@github.com
  - url: 'https://github.com/fatedier/frp/pull/5428'
    label: security-advisories@github.com
  - url: 'https://github.com/fatedier/frp/releases/tag/v0.70.1'
    label: security-advisories@github.com
  - url: 'https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp'
    label: security-advisories@github.com
  - url: 'https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/fatedier/frp'
tags:
  - nvd
  - osv
  - go
epss: 0.00524
epssPercentile: 0.41909
aliases:
  - GHSA-26gq-p25f-99cp
ecosystem: go
ingestedAt: '2026-08-13T19:18:20.918Z'
---

## Overview

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-73564)

Affected packages:

- `github.com/fatedier/frp >= 0.53.0, < 0.70.1`

Patched in:

- `github.com/fatedier/frp 0.70.1`

Source: https://osv.dev/vulnerability/GHSA-26gq-p25f-99cp