CVE-2026-54609

HIGH

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Title source: cna

Description

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

References (1)

Core 1

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f

Scores

CVSS v3 8.6

EPSS 0.0026

EPSS Percentile 18.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-400 CWE-406 CWE-770

Status published

Products (4)

com.quietterminal/qti-neon Maven

npm/qti-neon npm

pypi/qti-neon PyPI

Quiet-Terminal-Interactive/QTINeon 1.0.0

Published Jul 28, 2026

Tracked Since Jul 28, 2026