Frp
Monthly
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.