CVE-2026-54609 Details
Description
QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.
A denial-of-service vulnerability has been identified in QTI Neon version 1.0.0, a relay-based UDP multiplayer protocol library. The issue arises because the relay's reconnect handler forwards RECONNECT_REQUEST packets to the host without proper validation or size limitations. This flaw allows an unauthenticated client to exploit relay-to-host amplification, causing a denial-of-service condition on the host. The vulnerability is present in the 'NeonRelay' component across all three implementations: Java, Python, and TypeScript.
As of now, there is no fixed version available. However, operators can partially mitigate the issue by placing the relay behind a network-level filter that drops packets with spoofed source addresses, which eliminates the amplification path in most deployment environments.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Quiet-Terminal-Interactive QTI Neon | 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |