Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73564— frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Quick assessment

Affected
fatedier frp
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

frp 是一款高性能的反向代理工具。在版本 0.53.0 至 0.70.1 之间，frp 的可选 SSH 隧道网关（位于 ）在处理 SSH exec 通道请求时存在漏洞：它将攻击者可控的四字节大端序长度值加上 4。当该长度为 0xFFFFFFFF 时，会导致 类型加法发生整数溢出，结果回绕为 3，从而绕过对有效载荷长度的边界检查，进而在 方法中引发 切片越界 panic。 如果未配置 authorized-keys 文件， 配置允许未认证的客户端在 frp 令牌验证之前即进入该通道处理阶段。因此，攻击者只需发送一个

CVSS 8.7 · High EPSS 0.52% · P43

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
fatedier frp >= 0.53.0, < 0.70.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73564

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fatedier frp >= 0.53.0, < 0.70.1 -

II. Public POCs for CVE-2026-73564

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 10079 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-73564

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73564 (2)

Vendor Advisories for CVE-2026-73564 (1)

Vendor Pages for CVE-2026-73564 (1)

IV. Related Vulnerabilities

Same product: frp
Same vendor: fatedier
Same weakness: CWE-129

V. Comments for CVE-2026-73564

No comments yet

Leave a comment