Executive brief
QTINeon is a networking library used by multiplayer games to manage player connections through a relay server. A flaw in how the relay handles reconnection requests allows an unauthenticated attacker to flood the game host with traffic, potentially knocking the game offline. Because the relay is designed to hide the host's actual location, this vulnerability bypasses a primary security layer of the protocol.
Technical details
A vulnerability exists in the 'handleReconnectRequest' function of the QTINeon relay (Java, Python, and TypeScript implementations). The relay forwards RECONNECT_REQUEST packets to the host without enforcing a size limit on the 'pendingReconnects' map or deduplicating requests for the same session. An unauthenticated attacker can use spoofed source IP addresses to bypass per-source rate limiting, causing the relay to amplify traffic toward the host. Additionally, a secondary flaw in 'performCleanup' can cause the relay to reset rate-limiting state for all users, including legitimate ones, when a certain threshold of spoofed IPs is reached. No official patch is available, but operators can mitigate the amplification by implementing BCP38/uRPF filters to drop spoofed packets.
Affected products
- Quiet-Terminal-Interactive QTINeon 1.0.0
Timeline
- 2026-06-07: advisory: GitHub security advisory published by maintainer
- 2026-07-28: disclosed: CVE published to NVD dataset