Threats Tagged 'ghsa-26gq-p25f-99cp'

An integer overflow vulnerability in the frp server's SSH Tunnel Gateway allows an unauthenticated remote attacker to crash the entire frps process by sending a specially crafted five-byte message. This causes a slice bounds out-of-range panic in the Go runtime, terminating the server process and dropping all active tunnels. The vulnerability is reachable without authentication when the SSH Tunnel Gateway is enabled with no authorized-keys file, which is the default mode. There is no confidentiality or code execution impact. The issue affects frp versions from v0.53.0 through v0.70.0 with the SSH Tunnel Gateway enabled.