CVE-2026-54609
Received Received - Intake

QTI Neon UDP Relay Amplification DoS

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54609
EUVD
EUVD-2026-49905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quiet_terminal_interactive qti_neon to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-406 The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54609 is a high-severity denial-of-service vulnerability in QTINeon's relay system. The relay forwards RECONNECT_REQUEST packets to the host without proper size limits or deduplication. An unauthenticated attacker can exploit this by sending spoofed packets, causing the relay to amplify traffic and overwhelm the host.

Detection Guidance

Monitor for unusual traffic patterns involving RECONNECT_REQUEST packets sent to the relay host. Check for high volumes of UDP traffic from spoofed source addresses targeting the relay. Use network monitoring tools like tcpdump or Wireshark to capture and analyze UDP packets on the relay's ports.

Impact Analysis

This vulnerability allows attackers to perform denial-of-service attacks against the host by flooding it with amplified traffic. It can disrupt services, degrade performance, and potentially crash the host system. The attack is network-based and requires no authentication.

Compliance Impact

This vulnerability primarily impacts availability by enabling denial-of-service attacks through relay-to-host amplification. While not directly violating GDPR or HIPAA, it could indirectly affect compliance by disrupting services handling personal or health data, potentially leading to downtime or data unavailability.

Mitigation Strategies

Deploy network-level filters such as BCP38 or uRPF to block packets with spoofed source addresses. Rate-limit incoming UDP traffic to the relay and monitor for amplification attempts. Consider temporarily disabling the relay service if no patches are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart