{"id":"CVE-2026-73564","revision":"d4a7eb3f44014850a1729128bf6d6016","records":[{"revision":"d4a7eb3f44014850a1729128bf6d6016","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73564","aliases":[],"title":"frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes…","description":"frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.","state":0,"publishedAt":"2026-08-13T18:18:18.95+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"}],"references":["https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b","https://github.com/fatedier/frp/pull/5428","https://github.com/fatedier/frp/releases/tag/v0.70.1","https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73564","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-129","CWE-190"],"productCriteria":[],"sourceDates":{"published":"2026-08-13T18:18:18.950","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73564","identifiers":["CVE-2026-73564"]},"retained":false,"historicalAffected":[]}],"coverage":[]}