PT-2026-65539 · Qti Neon · Qtineon
CVE-2026-54609
·
Published
2026-07-28
·
Updated
2026-07-28
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
QTI Neon version 1.0.0
Description
In the
NeonRelay implementation across Java, Python, and TypeScript, the handleReconnectRequest function forwards RECONNECT REQUEST packets to the host without bounding them or implementing deduplication. An unauthenticated attacker with a valid session ID can send these packets using spoofed source addresses. Since the per-source rate limiter creates a new token bucket for each spoofed IP, the relay acts as an amplification vector, allowing a denial-of-service attack against the host. Additionally, when the number of spoofed IPs exceeds maxRateLimiters, the performCleanup function calls rateLimiters.clear(), which resets the rate limit state for all users, including legitimate ones.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, place the relay behind a network-level filter that drops packets with spoofed source addresses (BCP38/uRPF).
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Qtineon