frp CVE-2026-73564

The frps SSH Tunnel Gateway feature must be explicitly enabled in the server configuration - this is an opt-in component, and the majority of frp deployments not using it are entirely unaffected. Within the gateway, the default and documented operational mode is NoClientAuth=true (no authorized-keys file configured), allowing any SSH client to advance to the channel phase without SSH-level authentication; this is where the vulnerability is triggered, consistent with the CVSS PR:N metric. The frp token embedded in the SSH exec command - the normal mechanism by which the gateway authenticates users - is validated after the vulnerable channel-parsing code path and therefore provides no protection against this attack. Exploitation is bounded to frp versions 0.53.0 through 0.70.0; v0.70.1 and later are not affected. Operators who have configured a non-empty authorized-keys file force SSH public-key authentication before channel processing, preventing unauthenticated exploitation along this path, but this does not remediate the underlying integer overflow for authenticated SSH clients with valid keys.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately characterizes the threat profile: network-exposed, low complexity, no privileges required, no user interaction, and complete availability destruction with no confidentiality or integrity impact and no scope change beyond the frps process. The attack is stateless, single-packet, and trivially repeatable, making sustained denial of service straightforward once the attacker identifies an exposed gateway. This translates to a meaningful operational impact for any team relying on frp tunnels for access to internal infrastructure. EPSS data was not supplied in the available intelligence, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so no confirmed active exploitation exists at time of analysis; however, the GHSA advisory provides the complete integer arithmetic, exact code offsets, and payload construction in enough detail that even a mid-sized municipal IT team in tczew running frp for internal remote access should treat this as urgent rather than routine patching, given how little effort is required to translate the published advisory into a working crash payload. The primary exposure limiter is that the SSH Tunnel Gateway is an opt-in feature - operators not using it are entirely unaffected. The 'Information Disclosure' tag appearing in the source metadata directly conflicts with both the CVSS impact metrics (VC:N/VI:N) and the advisory description (availability-only DoS); this tag is assessed as a metadata labeling error and should not influence risk classification.

An unauthenticated attacker connects to the frps SSH Tunnel Gateway port, opens an SSH channel, and submits an exec channel request carrying exactly five bytes: a four-byte big-endian encoding of 0xFFFFFFFF followed by one arbitrary byte. The integer overflow computes an end index of 3, bypasses the bounds check, and causes Go's runtime to panic on the invalid payload[4:3] slice. Because no goroutine-level recovery handler exists, the panic terminates the entire frps process and drops all active tunnels for all connected clients; the attack requires no credentials, no prior state, and can be repeated indefinitely to sustain the outage. No formal public exploit code has been identified, though the GHSA advisory provides the exact arithmetic and payload specification necessary for trivial construction.