CVE-2026-54609 — HIGH (8.6)

Vulnerability Description

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-770 CWE-400 CWE-406

References

https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-8

FAQ

What is CVE-2026-54609?

CVE-2026-54609 is a vulnerability with a CVSS score of 8.6 (HIGH). QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding...

How severe is CVE-2026-54609?

CVE-2026-54609 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-54609?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.