Executive brief
A vulnerability in the frp reverse proxy server's SSH Tunnel Gateway allows an unauthenticated attacker to crash the entire server with a single small message. This component is used to provide SSH access to internal services, and an exploit results in a total service outage for all users and active tunnels. The issue is particularly severe because it can be triggered repeatedly to keep the service offline indefinitely.
Technical details
An integer overflow vulnerability exists in the frp server (frps) within the optional SSH Tunnel Gateway component. When parsing an SSH 'exec' channel request in 'pkg/ssh/server.go', the gateway adds a constant to an attacker-controlled 4-byte length field. A value of 0xFFFFFFFF causes a wraparound, bypassing bounds checks and leading to an out-of-range slice operation. This triggers a Go panic in a goroutine without a recovery handler, terminating the entire process. The vulnerability is reachable without authentication in the default gateway configuration. A fix is available in version 0.70.1.
Affected products
- fatedier frp >= 0.53.0, <= 0.70.0
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Fixed in version 0.70.1