CVE-2026-54609CWE-400CWE-406CWE-770

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

High · published July 28, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.9th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-406 · Insufficient Control of Network Message Volume (Network Amplification); CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-28T16:36Z
EPSS history
Timeline
  • 28 JUL 16:36Z
    QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
    cvelistv5