CVE-2026-73564
Received Received - Intake

SSH Exec Channel Handling Remote DoS in frp

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73564
EUVD
EUVD-2026-58179

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fatedier frp From 0.53.0 (inc) to 0.70.0 (inc)
fatedier frp 0.70.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73564 is an unauthenticated remote denial of service vulnerability in the FRP SSH Tunnel Gateway. It occurs when the server processes a malformed SSH exec request payload. An attacker sends a five-byte message with a crafted length value (0xFFFFFFFF) that causes an integer overflow during bounds checking. This leads to an out-of-range slice access, triggering a panic and crashing the entire frps process, dropping all active tunnels.

Detection Guidance

To detect CVE-2026-73564, check if your FRP server (frps) version is between 0.53.0 and 0.70.0. Run 'frps -v' to verify the version. If SSH Tunnel Gateway is enabled, monitor for crashes after receiving malformed SSH exec requests. Check logs for panic errors in pkg/ssh/server.go handling.

Impact Analysis

If you use FRP with the SSH Tunnel Gateway enabled (not default), an attacker could send a single malicious packet to crash your frps server. This would terminate all active tunnels for all users, causing a complete service outage. The attack requires no authentication and can be repeated to sustain the outage.

Mitigation Strategies

Upgrade FRP to version 0.70.1 or later immediately. Disable SSH Tunnel Gateway if not required by editing the frps configuration file and removing SSH-related settings. Restart the frps service after changes. Ensure no unauthorized access is permitted to the SSH gateway.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart