{"id":"CVE-2026-73564","sourceIdentifier":"security-advisories@github.com","published":"2026-08-13T18:18:18.950","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1."},{"lang":"es","value":"frp es un proxy inverso rápido. Desde la versión 0.53.0 hasta la 0.70.1, la puerta de enlace de túnel SSH opcional de frp en pkg/ssh/server.go analiza una solicitud de canal de ejecución SSH sumando 4 a una longitud big-endian de cuatro bytes controlada por el atacante. Una longitud de 0xFFFFFFFF hace que la suma uint32 se desborde a 3, anula la verificación de límites de la carga útil y provoca que payload[4:3] entre en pánico en TunnelServer.handleNewChannel. Cuando no se configura ningún archivo authorized-keys, sshConfig.NoClientAuth permite que un par no autenticado alcance esta fase del canal antes de que se verifique el token de frp, por lo que una única solicitud de cinco bytes termina el proceso frps y cierra cada túnel activo. Este problema se solucionó en la versión 0.70.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"fatedier","product":"frp","versions":[{"version":">= 0.53.0, < 0.70.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T17:52:30.634352Z","id":"CVE-2026-73564","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b","source":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/pull/5428","source":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/releases/tag/v0.70.1","source":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp","source":"security-advisories@github.com"},{"url":"https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}