Executive brief
Cloudburst Network is a library used to handle network communications for software projects. A flaw in how the library handles certain network connections allows a remote attacker to crash the communication channel, making the affected software unreachable or unusable. This results in a denial-of-service where legitimate users cannot connect to the service.
Technical details
A vulnerability exists in Cloudburst Network (specifically the netty-transport-raknet component) due to improper input validation during connection handling. An unauthenticated remote attacker can exploit this bug to trigger the closure of the parent Netty channel. This action renders the network transport layer inoperable, leading to a complete denial-of-service for the application. The issue is addressed in version 1.0.0.CR3-20260418.124334-32. Downstream projects like Geyser are also affected and should update to builds containing the patched library.
Affected products
- CloudburstMC Network (netty-transport-raknet) < 1.0.0.CR3-20260418.124334-32
Timeline
- 2026-05-12: advisory: GitHub advisory published by maintainers
- 2026-06-05: disclosed: NVD publication date