CVE-2026-110619

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110619
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110619.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110619
Published
2026-10-14T14:16:57Z
Modified
2026-10-15T10:47:30Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
Details

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110619.json"
}
References

Affected packages

Git / github.com/fatedier/frp

Affected ranges

Type
GIT
Repo
https://github.com/fatedier/frp
Events
Introduced
10f26201316ff99b4cd6bd3fde9526e1c9c5a95a
Last Affected
d8cf1800dc1abd7fda1828cab105d7a6b5a50eb1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.41.0"
        },
        {
            "last_affected":  "0.71.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.46.1
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.51.0
v0.51.1
v0.51.2
v0.51.3
v0.52.0
v0.52.1
v0.52.2
v0.52.3
v0.53.0
v0.53.1
v0.53.2
v0.54.0
v0.55.0
v0.55.1
v0.56.0
v0.57.0
v0.58.0
v0.58.1
v0.59.0
v0.60.0
v0.61.0
v0.61.1
v0.61.2
v0.62.0
v0.62.1
v0.63.0
v0.64.0
v0.65.0
v0.66.0
v0.67.0
v0.68.0
v0.68.1
v0.69.0
v0.69.1
v0.70.0
v0.70.1
v0.71.0
v0.71.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110619.json"