The frp server's SSH Tunnel Gateway contains an integer overflow vulnerability triggered by an attacker-controlled four-byte length field in an SSH exec channel request. Adding a constant to the maximum 32-bit unsigned integer value wraps around, causing a bounds check to be bypassed and leading to a slice operation with invalid indices. This triggers a Go runtime panic that is not recovered, crashing the entire frps process. The vulnerability is exploitable without authentication when the gateway is enabled without an authorized-keys file, allowing an unauthenticated attacker to cause a denial of service by repeatedly crashing the server. The vulnerability affects frp versions >=0.53.0 and <0.70.1, confirmed on v0.70.0.

An unauthenticated remote attacker can cause a denial of service by crashing the frps server process with a single crafted message, resulting in all active tunnels being dropped and new connections refused until the server is restarted. The crash is trivially repeatable, enabling sustained outages. There is no impact on confidentiality, integrity, or code execution. Only frps instances with the SSH Tunnel Gateway explicitly enabled and configured without client authentication are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, do not enable the SSH Tunnel Gateway or configure it with an authorized-keys file to require client authentication. Disabling the SSH Tunnel Gateway or enabling client authentication prevents unauthenticated access to the vulnerable code path.