{"items":[{"id":"NVI-00015167","kind":"vulnerability","title":"frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-26gq-p25f-99cp","CVE-2026-73564"],"plain_summary":"GitHub lists this reviewed advisory for github.com/fatedier/frp. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-344baea0358e2586767c1909b44560cf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-344baea0358e2586767c1909b44560cf","url":"https://github.com/advisories/GHSA-26gq-p25f-99cp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-26gq-p25f-99cp","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:16:47.162Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-344baea0358e2586767c1909b44560cf"],"technology":"github.com/fatedier/frp","known_exclusions":[],"conditions_summary":"## Summary\n\nAn integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps` process with a single five-byte message. When the gateway parses an SSH `exec` channel request in `pkg/ssh/server.go`, it adds a small constant to a four-byte length value taken directly from the request. Because that length is fully attacker-controlled, a value of `0xFFFFFFFF` makes the addition wrap around to a tiny number, defeating the only bounds check and forcing an out-of-range slice. Go raises a panic that nothing recovers, so the whole server exits. In the default gateway mode SSH clients are not authenticated and the request is handled before any frp token is checked, so the crash is reachable pre-authentication. It carries no state and is trivially repeatable, turning one crash into a sustained outage that drops every tunnel for every user.\n\n## Details\n\nThe `exec` request payload is a four-byte big-endian length followed by that many command bytes, and the length field is fully attacker-controlled. The gateway computes the end of the command as `4 + length`. The constant `4` takes the `uint32` type of the length fi","public_affected_ranges":[">= 0.53.0, <= 0.70.0"]}],"null_published_at":"2026-11-03T10:03:26.556Z","source_updated_at":"2026-08-13T17:35:54.000Z","source_disclosed_at":"2026-07-24T21:48:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:16:47.162Z"}],"next_cursor":null,"snapshot_revision":"42594"}