CVE-2026-54609: Uncontrolled Resource Consumption and Network Amplification in QTINeon

QTINeon is a game-agnostic, relay-based UDP multiplayer protocol library developed by Quiet-Terminal-Interactive. In its architecture, the relay server facilitates connections between remote clients and the game host, bypassing NAT restrictions and hiding the host's direct IP address. The system relies on specific UDP packet headers to manage state transitions, including session establishment and reconnections.

Version 1.0.0 of the library exposes an unprotected reconnect flow that can be targeted by remote attackers. While primary connection handshakes implement rate limits and table size constraints, the reconnect request handler lacks these essential security controls. This deficiency introduces a direct path to denial of service through memory exhaustion and packet forwarding amplification.

The underlying flaw resides within the reconnect processing mechanism, specifically the handleReconnectRequest function. When a client drops offline or attempts to resume an active session, it transmits a RECONNECT_REQUEST packet to the relay. The relay processes this request by registering it inside an internal mapping table named pendingReconnects to track the state of active handshakes.

Two critical flaws are present in this implementation. First, the pendingReconnects map does not enforce a maximum size boundary, meaning the server continues to allocate memory for every unique request it receives. Second, the handler performs no deduplication or rate limiting on incoming client identifiers, allowing a single sender to flood the server and force continuous map insertions.

As a consequence of these design gaps, the relay immediately routes every processed reconnect packet to the game host. The host is forced to process an unthrottled volume of handshakes, leading to system resource exhaustion.

The following code block demonstrates the difference between the vulnerable implementation in version 1.0.0 and a secure implementation that mitigates the resource allocation and forwarding flaws.

// VULNERABLE: Version 1.0.0 lack of size constraints and validation
public void handleReconnectRequest(ReconnectPacket packet, IPEndPoint clientEndPoint) {
    // No check on pendingReconnects dictionary size
    // No deduplication or validation of packet details
    pendingReconnects[packet.ClientId] = new ReconnectState(packet, DateTime.UtcNow);
    
    // Direct forwarding to host without rate limiting or validation
    ForwardToHost(packet);
}

To remediate this, developers must manually add size-limiting guard clauses, request deduplication, and a timer-based pruning task. The secure pattern checks map thresholds and discards duplicate requests before allocating memory or forwarding traffic.

// SECURE: Implementing bounds checking, deduplication, and rate controls
private const int MaxPendingReconnects = 1024;
 
public void handleReconnectRequest(ReconnectPacket packet, IPEndPoint clientEndPoint) {
    // 1. Enforce size limit to prevent memory exhaustion
    if (pendingReconnects.Count >= MaxPendingReconnects) {
        return;
    }
    
    // 2. Prevent duplicate entries from the same client ID
    if (pendingReconnects.ContainsKey(packet.ClientId)) {
        return;
    }
    
    // 3. Track state with timestamp for automatic expiration
    pendingReconnects[packet.ClientId] = new ReconnectState(packet, DateTime.UtcNow);
    
    // 4. Forward with rate limiting applied
    ForwardToHostWithRateLimit(packet);
}

Exploitation of CVE-2026-54609 requires network access to the UDP port exposed by the QTINeon relay server. An attacker does not require authentication or valid session credentials to interact with the reconnect handler. By generating spoofed UDP packets containing a structured RECONNECT_REQUEST header, the attacker initiates the exploit.

The attacker sends a stream of unique client reconnect requests at a rapid rate. Each packet causes the relay to allocate dynamic memory for a new session structure in the pendingReconnects map. Within seconds, this unconstrained allocation consumes the available memory on the relay host, causing the process to terminate due to out-of-memory errors.

Simultaneously, the relay server acts as an amplifier by forwarding each packet to the target game host. Because the host must process every handshake attempt originating from the trusted relay, its network interface and processor become saturated, disconnecting legitimate players.

The security impact of this vulnerability is scored at 8.6 on the CVSS scale, indicating high severity. The CVSS vector highlights that the attack can be executed remotely with low complexity and no privileges. The scope is changed because exploiting the relay server directly impacts the availability of the game host.

Successful exploitation results in a complete denial of service for both the relay and the backend game host. The relay process suffers from memory exhaustion, while the game host experiences network bandwidth saturation and CPU exhaustion. There is no impact on confidentiality or integrity, as the vulnerability does not allow unauthorized data access or modifications.

No official patch is currently available for QTINeon version 1.0.0. Organizations deploying this library must implement custom code-level fixes to defend their infrastructure. The primary remediation strategy is the introduction of a maximum capacity constraint on the pendingReconnects mapping table.

Additionally, developers must implement a scheduled pruning routine that automatically evicts handshake entries older than 5 to 10 seconds. Network administrators should deploy rate-limiting rules on routers or firewalls to limit incoming UDP traffic on the relay's service port. Implementing IDS signatures to detect anomalous rates of reconnection request patterns is also recommended.