CVE-2026-73564

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73564", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T20:53:46.380Z", "datePublished": "2026-08-13T17:35:46.762Z", "dateUpdated": "2026-08-13T17:53:06.534Z"}, "containers": {"cna": {"title": "frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp"}, {"name": "https://github.com/fatedier/frp/pull/5428", "tags": ["x_refsource_MISC"], "url": "https://github.com/fatedier/frp/pull/5428"}, {"name": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b", "tags": ["x_refsource_MISC"], "url": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b"}, {"name": "https://github.com/fatedier/frp/releases/tag/v0.70.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/fatedier/frp/releases/tag/v0.70.1"}], "affected": [{"vendor": "fatedier", "product": "frp", "versions": [{"version": ">= 0.53.0, < 0.70.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:35:46.762Z"}, "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1."}], "source": {"advisory": "GHSA-26gq-p25f-99cp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:52:30.634352Z", "id": "CVE-2026-73564", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:53:06.534Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73564", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:52:30.634352Z"}}}], "references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:52:46.490Z"}}], "cna": {"title": "frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow", "source": {"advisory": "GHSA-26gq-p25f-99cp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "fatedier", "product": "frp", "versions": [{"status": "affected", "version": ">= 0.53.0, < 0.70.1"}]}], "references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "name": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fatedier/frp/pull/5428", "name": "https://github.com/fatedier/frp/pull/5428", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b", "name": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fatedier/frp/releases/tag/v0.70.1", "name": "https://github.com/fatedier/frp/releases/tag/v0.70.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:35:46.762Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73564", "state": "PUBLISHED", "dateUpdated": "2026-08-13T17:53:06.534Z", "dateReserved": "2026-08-12T20:53:46.380Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T17:35:46.762Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "frp", "vendor": "fatedier", "versions": [{"status": "affected", "version": ">= 0.53.0, < 0.70.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1."}, {"lang": "es", "value": "frp es un proxy inverso r\u00e1pido. Desde la versi\u00f3n 0.53.0 hasta la 0.70.1, la puerta de enlace de t\u00fanel SSH opcional de frp en pkg/ssh/server.go analiza una solicitud de canal de ejecuci\u00f3n SSH sumando 4 a una longitud big-endian de cuatro bytes controlada por el atacante. Una longitud de 0xFFFFFFFF hace que la suma uint32 se desborde a 3, anula la verificaci\u00f3n de l\u00edmites de la carga \u00fatil y provoca que payload[4:3] entre en p\u00e1nico en TunnelServer.handleNewChannel. Cuando no se configura ning\u00fan archivo authorized-keys, sshConfig.NoClientAuth permite que un par no autenticado alcance esta fase del canal antes de que se verifique el token de frp, por lo que una \u00fanica solicitud de cinco bytes termina el proceso frps y cierra cada t\u00fanel activo. Este problema se solucion\u00f3 en la versi\u00f3n 0.70.1."}], "id": "CVE-2026-73564", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73564", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T17:52:30.634352Z", "version": "2.0.3"}}]}, "published": "2026-08-13T18:18:18.950", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b"}, {"source": "security-advisories@github.com", "url": "https://github.com/fatedier/frp/pull/5428"}, {"source": "security-advisories@github.com", "url": "https://github.com/fatedier/frp/releases/tag/v0.70.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.53.0,0.70.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "frp", "source": "cna", "vendor": "fatedier"}, "product": "frp", "vendor": "fatedier"}], "created": "2026-08-13T18:30:16.130871+00:00", "updated": "2026-08-13T18:45:04.406039+00:00", "vendors": ["fatedier", "fatedier$PRODUCT$frp"]}