Skip to main content

frp EUVDEUVD-2026-58179

| CVE-2026-73564 HIGH
Improper Validation of Array Index (CWE-129)
2026-08-13 GitHub_M GHSA-26gq-p25f-99cp
Information Disclosure Frp
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-exposed SSH gateway port, no authentication required in default NoClientAuth mode, complete process crash with availability-only impact and no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 19:04 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 18:24 vuln.today
Analysis Generated
Aug 13, 2026 - 18:24 vuln.today
CVE Published
Aug 13, 2026 - 17:35 cve.org
HIGH 8.7

DescriptionCVE.org

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.

AnalysisAI

Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Connect to frps SSH gateway port
Delivery
Open SSH channel
Exploit
Submit exec request with length field=0xFFFFFFFF
Install
uint32 addition overflows to 3
C2
Bounds check 5 < 3 evaluates false, bypassed
Execute
payload[4:3] slice triggers Go runtime panic
Impact
Unrecovered panic terminates frps process, all tunnels dropped
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The frps SSH Tunnel Gateway feature must be explicitly enabled in the server configuration - this is an opt-in component, and the majority of frp deployments not using it are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately characterizes the threat profile: network-exposed, low complexity, no privileges required, no user interaction, and complete availability destruction with no confidentiality or integrity impact and no scope change beyond the frps process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker connects to the frps SSH Tunnel Gateway port, opens an SSH channel, and submits an exec channel request carrying exactly five bytes: a four-byte big-endian encoding of 0xFFFFFFFF followed by one arbitrary byte. The integer overflow computes an end index of 3, bypasses the bounds check, and causes Go's runtime to panic on the invalid payload[4:3] slice. …
Remediation Upgrade frp to version 0.70.1, which patches the integer overflow in the SSH exec channel request parser via commit 7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b (PR https://github.com/fatedier/frp/pull/5428, release https://github.com/fatedier/frp/releases/tag/v0.70.1). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running frp versions 0.53.0 through 0.70.0 with SSH Tunnel Gateway enabled and assess internet accessibility via vulnerability scanning or network inventory. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Frp

View all
CVE-2026-40910 MEDIUM
6.5 Apr 21

Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-58179 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy