Executive brief
A vulnerability in the Rust Steamworks library can allow a malicious user to crash game servers or other players' game clients. The library is used by developers to integrate Steam features like multiplayer authentication into their games. By sending a specially crafted authentication request, an attacker can trigger a software crash (panic), leading to a denial of service for the affected game session.
Technical details
The steamworks-rs library (Rust bindings for the Steamworks SDK) contains an unhandled enum variant in the `ValidateAuthTicketResponse::from_raw` function. Specifically, when the `m_eAuthSessionResponse` field returns `k_EAuthSessionResponseAuthTicketNetworkIdentityFailure`, the library triggers an `unreachable!` panic. An attacker can exploit this by sending an authentication ticket with a network identity that does not match the verifier's identity. This affects both game clients and servers using the `begin_authentication_session` API. The issue is fixed in version 0.13.1.
Affected products
- Noxime steamworks-rs (steamworks crate) < 0.13.1
Timeline
- 2026-04-24: disclosed: Issue reported on GitHub repository
- 2026-05-06: advisory: RustSec advisory issued
- 2026-05-11: patched: GitHub advisory published and version 0.13.1 released