CVE-2026-54609 QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
An unauthenticated attacker can cause denial of service on the host by exploiting unbounded packet forwarding in the QTINeon relay library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54609?
CVE-2026-54609 is a high-severity denial of service vulnerability in Quiet-Terminal-Interactive QTINeon, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.
Which versions are affected by CVE-2026-54609?
7 open source packages ship an affected version, including qti-neon and com.quietterminal:qti-neon.
| Package | Affected | Fixed in |
|---|---|---|
qti-neon PyPI | All versions | None |
qti-neon PyPI | All versions | None |
qti-neon PyPI | All versions | None |
qti-neon npm | All versions | None |
qti-neon npm | All versions | None |
com.quietterminal:qti-neon Maven | All versions | None |
1 more packages
com.quietterminal:qti-neon Maven | All versions | None |
How do I fix CVE-2026-54609?
No fix has been published for CVE-2026-54609 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54609 being exploited?
There is no known exploitation of CVE-2026-54609 in the wild and no public exploit code.
Sources
Also known as GHSA-85rg-p3fr-xc2f, PYSEC-2026-3615.