{"vulnerability": "ghsa-85rg-p3fr-xc2f", "sightings": [{"uuid": "7fc4aeb4-07be-4b49-93ee-32014823bcd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-85rg-p3fr-xc2f", "type": "seen", "source": "https://gist.github.com/alon710/543be0bac4447ae891730d56e63e4ffd", "content": "# CVE-2026-54609: CVE-2026-54609: Uncontrolled Resource Consumption and Network Amplification in QTINeon\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54609\n\n## Summary\nQuiet-Terminal-Interactive's QTINeon version 1.0.0 is vulnerable to uncontrolled resource consumption and relay-to-host network amplification. The reconnect request handler lacks table size constraints, rate limiting, and request deduplication, allowing unauthenticated attackers to crash the relay server and overwhelm target hosts.\n\n## TL;DR\nAn unauthenticated remote attacker can exploit the QTINeon reconnect handler to exhaust relay server memory and launch network amplification attacks against target game hosts.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.6\n- **Scope**: Changed (S:C)\n- **Impact**: Availability (A:H)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- QTINeon UDP Relay Server\n- **QTINeon**: == 1.0.0 (Fixed in: `None`)\n\n## Mitigation\n\n- Enforce hard limits on the size of internal state mapping tables.\n- Implement request deduplication based on unique client identifiers.\n- Apply rate limiting to all packet-forwarding functions in the relay.\n- Enforce automated timed pruning of stale connection mappings.\n\n**Remediation Steps:**\n1. Open the QTINeon server source code files containing the reconnect logic.\n2. Locate the handleReconnectRequest function processing RECONNECT_REQUEST packets.\n3. Declare a maximum capacity limit constant (e.g., MaxPendingReconnects = 1024).\n4. Add a validation check at the beginning of the function to reject incoming packets if the size threshold is exceeded.\n5. Check if the unique client ID is already present in the map; discard duplicate requests.\n6. Integrate a background timer or polling job that sweeps and purges expired entries from the dictionary.\n\n## References\n\n- [GitHub Security Advisory (GHSA)](https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54609)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54609) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T19:31:15.524407Z"}]}