Vulnerability-Lookup

CVE-2026-54609 (GCVE-0-2026-54609)

Vulnerability from cvelistv5 – Published: 2026-07-28 16:36 – Updated: 2026-07-28 17:07

Title

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Summary

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 17:06 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-406 - Insufficient Control of Network Message Volume (Network Amplification)
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/Quiet-Terminal-Interactive/QTI…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Quiet-Terminal-Interactive	QTINeon	Affected: 1.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T17:06:51.523197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T17:07:15.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QTINeon",
          "vendor": "Quiet-Terminal-Interactive",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay\u0027s handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-406",
              "description": "CWE-406: Insufficient Control of Network Message Volume (Network Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T16:36:37.938Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
        }
      ],
      "source": {
        "advisory": "GHSA-85rg-p3fr-xc2f",
        "discovery": "UNKNOWN"
      },
      "title": "QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54609",
    "datePublished": "2026-07-28T16:36:37.938Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-07-28T17:07:15.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54609",
      "date": "2026-10-01",
      "epss": "0.0046",
      "percentile": "0.37546"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "QTINeon",
                "vendor": "Quiet-Terminal-Interactive",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.0.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay\u0027s handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review."
          }
        ],
        "id": "CVE-2026-54609",
        "lastModified": "2026-07-30T19:59:01.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54609",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T17:06:51.523197Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T17:16:52.507",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-406"
              },
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54609",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T17:06:51.523197Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T17:06:56.770Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "QTINeon",
              "vendor": "Quiet-Terminal-Interactive",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.0.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay\u0027s handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-406",
                  "description": "CWE-406: Insufficient Control of Network Message Volume (Network Amplification)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T16:36:37.938Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
            }
          ],
          "source": {
            "advisory": "GHSA-85rg-p3fr-xc2f",
            "discovery": "UNKNOWN"
          },
          "title": "QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54609",
        "datePublished": "2026-07-28T16:36:37.938Z",
        "dateReserved": "2026-06-15T19:45:23.540Z",
        "dateUpdated": "2026-07-28T17:07:15.080Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-342150

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:55

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:55:11.456711+00:00",
  "id": "EUVD-2026-342150"
}

FKIE_CVE-2026-54609

Vulnerability from fkie_nvd - Published: 2026-07-28 17:16 - Updated: 2026-07-30 19:59

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "QTINeon",
          "vendor": "Quiet-Terminal-Interactive",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay\u0027s handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review."
    }
  ],
  "id": "CVE-2026-54609",
  "lastModified": "2026-07-30T19:59:01.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54609",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T17:06:51.523197Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T17:16:52.507",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-406"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-85RG-P3FR-XC2F

Vulnerability from github – Published: 2026-07-28 16:36 – Updated: 2026-07-28 16:36

Summary

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Details

Impact

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter assigns a fresh token bucket to each spoofed IP, it provides no protection. The host receives one forwarded packet per spoofed source per cleanup cycle, making the relay an amplification vector for denial-of-service against the host. The host's real address is never exposed to clients by design, so this is the primary viable DoS path against it. A secondary issue: once more than maxRateLimiters spoofed IPs are seen, performCleanup calls rateLimiters.clear(), resetting rate limit state for all sources including legitimate ones.

Affected: NeonRelay in all three implementations (Java, Python, TypeScript).

Patches

Not yet patched. Fix consists of three changes to handleReconnectRequest in each implementation:

Reject the request if pendingReconnects.size() >= maxPendingConnections (mirrors the existing connect-flow guard)
Only forward to the host if the sessionId:clientId key is not already present in pendingReconnects — the map entry can still be updated with the new source address, but the host only needs to validate once per slot
In performCleanup, evict throttled entries before falling back to rateLimiters.clear() to avoid resetting legitimate sources' rate limit state

Workarounds

Operators can partially mitigate by placing the relay behind a network-level filter that drops packets with spoofed source addresses (BCP38/uRPF). This does not address the missing pendingReconnects size cap or the rateLimiters.clear() issue but eliminates the amplification path in most deployment environments.

References

PROTOCOL.md — reconnect flow
ARCHITECTURE.md — reconnect handshake detail (step 4 describes the unbounded put)

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.quietterminal:qti-neon"
      },
      "versions": [
        "1.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "qti-neon"
      },
      "versions": [
        "1.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qti-neon"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-406",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T16:36:47Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nThe relay\u0027s reconnect handler forwards every `RECONNECT_REQUEST` to the host without deduplication or a size cap on the `pendingReconnects` map, unlike the connect flow which guards against this with `maxPendingConnections`. An unauthenticated attacker who knows a valid session ID can send `RECONNECT_REQUEST` packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter assigns a fresh token bucket to each spoofed IP, it provides no protection. The host receives one forwarded packet per spoofed source per cleanup cycle, making the relay an amplification vector for denial-of-service against the host. The host\u0027s real address is never exposed to clients by design, so this is the primary viable DoS path against it. A secondary issue: once more than `maxRateLimiters` spoofed IPs are seen, `performCleanup` calls `rateLimiters.clear()`, resetting rate limit state for all sources including legitimate ones.\n\nAffected: `NeonRelay` in all three implementations (Java, Python, TypeScript).\n\n### Patches\nNot yet patched. Fix consists of three changes to handleReconnectRequest in each implementation:\n\n1. Reject the request if `pendingReconnects.size() \u003e= maxPendingConnections` (mirrors the existing connect-flow guard)\n2. Only forward to the host if the `sessionId:clientId` key is not already present in `pendingReconnects` \u2014 the map entry can still be updated with the new source address, but the host only needs to validate once per slot\n3. In `performCleanup`, evict throttled entries before falling back to `rateLimiters.clear()` to avoid resetting legitimate sources\u0027 rate limit state\n\n### Workarounds\nOperators can partially mitigate by placing the relay behind a network-level filter that drops packets with spoofed source addresses (BCP38/uRPF). This does not address the missing `pendingReconnects` size cap or the `rateLimiters.clear()` issue but eliminates the amplification path in most deployment environments.\n\n### References\n- PROTOCOL.md \u2014 reconnect flow\n- ARCHITECTURE.md \u2014 reconnect handshake detail (step 4 describes the unbounded `put`)",
  "id": "GHSA-85rg-p3fr-xc2f",
  "modified": "2026-07-28T16:36:47Z",
  "published": "2026-07-28T16:36:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding"
}

PYSEC-2026-3615

Vulnerability from pysec - Published: 2026-08-04 11:34 - Updated: 2026-08-04 11:34

Details

Impact

Affected: NeonRelay in all three implementations (Java, Python, TypeScript).

Patches

Not yet patched. Fix consists of three changes to handleReconnectRequest in each implementation:

Reject the request if pendingReconnects.size() >= maxPendingConnections (mirrors the existing connect-flow guard)
Only forward to the host if the sessionId:clientId key is not already present in pendingReconnects — the map entry can still be updated with the new source address, but the host only needs to validate once per slot
In performCleanup, evict throttled entries before falling back to rateLimiters.clear() to avoid resetting legitimate sources' rate limit state

Workarounds

References

PROTOCOL.md — reconnect flow
ARCHITECTURE.md — reconnect handshake detail (step 4 describes the unbounded put)

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Impacted products

Name	purl
qti-neon	pkg:pypi/qti-neon

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "qti-neon",
        "purl": "pkg:pypi/qti-neon"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54609",
    "GHSA-85rg-p3fr-xc2f"
  ],
  "details": "### Impact\nThe relay\u0027s reconnect handler forwards every `RECONNECT_REQUEST` to the host without deduplication or a size cap on the `pendingReconnects` map, unlike the connect flow which guards against this with `maxPendingConnections`. An unauthenticated attacker who knows a valid session ID can send `RECONNECT_REQUEST` packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter assigns a fresh token bucket to each spoofed IP, it provides no protection. The host receives one forwarded packet per spoofed source per cleanup cycle, making the relay an amplification vector for denial-of-service against the host. The host\u0027s real address is never exposed to clients by design, so this is the primary viable DoS path against it. A secondary issue: once more than `maxRateLimiters` spoofed IPs are seen, `performCleanup` calls `rateLimiters.clear()`, resetting rate limit state for all sources including legitimate ones.\n\nAffected: `NeonRelay` in all three implementations (Java, Python, TypeScript).\n\n### Patches\nNot yet patched. Fix consists of three changes to handleReconnectRequest in each implementation:\n\n1. Reject the request if `pendingReconnects.size() \u003e= maxPendingConnections` (mirrors the existing connect-flow guard)\n2. Only forward to the host if the `sessionId:clientId` key is not already present in `pendingReconnects` \u2014 the map entry can still be updated with the new source address, but the host only needs to validate once per slot\n3. In `performCleanup`, evict throttled entries before falling back to `rateLimiters.clear()` to avoid resetting legitimate sources\u0027 rate limit state\n\n### Workarounds\nOperators can partially mitigate by placing the relay behind a network-level filter that drops packets with spoofed source addresses (BCP38/uRPF). This does not address the missing `pendingReconnects` size cap or the `rateLimiters.clear()` issue but eliminates the amplification path in most deployment environments.\n\n### References\n- PROTOCOL.md \u2014 reconnect flow\n- ARCHITECTURE.md \u2014 reconnect handshake detail (step 4 describes the unbounded `put`)",
  "id": "PYSEC-2026-3615",
  "modified": "2026-08-04T11:34:43.795548Z",
  "published": "2026-08-04T11:34:43.795548Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Quiet-Terminal-Interactive/QTINeon"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/qti-neon"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-85rg-p3fr-xc2f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54609"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54609 (GCVE-0-2026-54609)

EUVD-2026-342150

FKIE_CVE-2026-54609

GHSA-85RG-P3FR-XC2F

Impact

Patches

Workarounds

References

PYSEC-2026-3615

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature

Related by attack behaviour