306 matches found
GO-2024-3302 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache, spegel, k3s, cloudflared, q, caddy, buf, frp...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: flannel, rancher, kube-bench, amazon-k8s-cni, zarf, crossplane-provider-aws-cloudwatchlogs, kbld, kaniko, calico, kubescape, aws-flb-cloudwatch, speedtest-go, spqr, sops, bank-vaults, cluster-api-ipam-provider-in-cluster, crossplane-provider-azure-authorization,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: redis-operator, flannel, vault-secrets-webhook, git-credential-oauth, kube-bench, crossplane-provider-aws-cloudwatchlogs, kbld, custom-pod-autoscaler, calico, nri-f5, ratify, helm-set-status, aws-flb-cloudwatch, dex, spqr, sops, bank-vaults,...
CVE-2026-73564
creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:15+00:00| published-proof-of-concept| https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp...
CVE-2026-73564
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...
CVE-2026-73564 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...
EUVD-2026-58179
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...
CVE-2026-73564 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...
CVE-2026-73564
The CVE affects frp (frps) with the SSH Tunnel Gateway enabled. A root cause was an integer overflow in parsing an SSH exec channel: the code adds 4 to an attacker-controlled 4-byte length, and 0xFFFFFFFF wraps to 3, causing a bounds check bypass and a panic in TunnelServer.handleNewChannel. When...
CVE-2026-73564: Improper Validation of Array Index
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...
SUSE CVE-2026-40910
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser...
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...
GHSA-26GQ-P25F-99CP frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...
PT-2026-71712
Name of the Vulnerable Software and Affected Versions frp versions 0.53.0 through 0.70.0 Description The optional SSH Tunnel Gateway in pkg/ssh/server.go incorrectly parses SSH exec channel requests by adding 4 to a four-byte big-endian length controlled by the user. Providing a length of...
Exploit for Use After Free in Linux Linux_Kernel
Mi 8e5 Unlock Toolkit Automated bootloader unlock assistant f...
GO-2026-5549 frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control in github.com/fatedier/frp
frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control in github.com/fatedier/frp...
CVE-2026-40910
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser...
CVE-2026-40898 vulnerabilities
Vulnerabilities for packages: k8sgateway, kube-metrics-adapter, kubo, kyverno-policy-reporter, traefik, kubernetes-dns-node-cache, teleport, spegel, ipfs-cluster, k3s, dkron, opentelemetry-operator, q, jitsucom-bulker, coredns, kargo, frp, kyverno-policy-reporter-ui...
GHSA-VVGJ-X9JQ-8CJ9 vulnerabilities
Vulnerabilities for packages: k8sgateway, kube-metrics-adapter, kubo, kyverno-policy-reporter, traefik, kubernetes-dns-node-cache, teleport, spegel, ipfs-cluster, k3s, dkron, opentelemetry-operator, q, jitsucom-bulker, coredns, kargo, frp, kyverno-policy-reporter-ui...
CVE-2026-40910
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser...