CVE-2026-73564

Name of the Vulnerable Software and Affected Versions frp versions 0.53.0 through 0.70.0

Description The optional SSH Tunnel Gateway in pkg/ssh/server.go incorrectly parses SSH exec channel requests by adding 4 to a four-byte big-endian length controlled by the user. Providing a length of 0xFFFFFFFF causes a uint32 integer wrap to 3, bypassing payload bounds checks and triggering a panic in the handleNewChannel() function of TunnelServer. If no authorized-keys file is configured and sshConfig.NoClientAuth is enabled, an unauthenticated peer can trigger this panic before the frp token is verified, resulting in the termination of the frps process and the disconnection of all active tunnels.

Recommendations Update to version 0.70.1.