Loading story…
A high-severity vulnerability, CVE-2026-54609, has been disclosed in Quiet-Terminal-Interactive's QTINeon 1.0.0 UDP multiplayer protocol library and relay server. The flaw lies in the reconnect request handling path, where the relay forwards RECONNECT_REQUEST packets to the host without proper bounds checking and maintains a pendingReconnects table without effective limits, deduplication, or rate limiting. An unauthenticated remote attacker can exploit the exposed UDP service with only network access and no valid session credentials.
Successful exploitation can exhaust relay memory and cause denial of service on the relay while also creating relay-to-host amplification that drives excess traffic and processing load toward the game host, potentially saturating bandwidth and CPU. The issue is tracked in GHSA-85rg-p3fr-xc2f and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. No official fix was available at publication, leaving mitigations such as code-level limits, pruning stale reconnect entries, and network rate limiting as the primary defensive measures.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity vulnerability, CVE-2026-54609, was disclosed in Quiet-Terminal-Interactive's QTINeon 1.0.0 UDP multiplayer protocol library. The flaw allows unauthenticated remote clients to trigger uncontrolled resource consumption and relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding, with no fixed version available at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP disclosed two high-severity vulnerabilities affecting its **QVR Pro** and **QuNetSwitch** products that could be exploited remotely without authentication or user interaction. **CVE-2026-22898** is a missing authentication for critical function flaw in QVR Pro, classified as `CWE-306`, that can let remote attackers gain access to the system. QNAP said the issue is fixed in **QVR Pro 2.7.4.14** and later and published advisory **QSA-26-07**. QNAP also addressed **CVE-2026-22897**, a `CWE-78` command injection flaw in **QuNetSwitch** that could allow remote attackers to execute arbitrary commands on vulnerable devices. The company said the bug was fixed in **QuNetSwitch 2.0.4.0415** and later. Both CVE records carry **CVSS v4.0** assessments indicating network-based exploitation with low attack complexity, no required privileges, and no user interaction, making prompt patching a priority for exposed systems.
Jun 29, 2026
A remotely triggerable heap buffer overflow in **Knot Resolver 6.3.0** allows unauthenticated remote code execution through the `kresd` DNS-over-QUIC listener. The flaw stems from incorrect size tracking during inbound QUIC `STREAM` frame reassembly, causing a later `memcpy()` to write past an allocated heap buffer. Public reporting said a single QUIC connection carrying six crafted `STREAM` frames can produce a controlled out-of-bounds write and, with heap grooming, overwrite a `libgnutls` cleanup handler to seize control of a function pointer and argument. Researchers classified the issue as **`CWE-787`** and demonstrated end-to-end RCE in a Debian 12 lab environment with ASLR disabled; failed attempts can also crash worker processes and cause denial of service. CZ.NIC fixed the vulnerability in **Knot Resolver 6.4.1**, and full technical details plus working proof-of-concept exploit code were disclosed publicly shortly after the patch release. No in-the-wild exploitation has been confirmed, but the exposure is significant because Knot Resolver is deployed by major ISPs and handles untrusted network traffic, raising the risk of resolver compromise and forged DNS responses for downstream users. Organizations are being urged to upgrade to **6.4.1** immediately; if patching cannot be completed at once, defenders should disable DNS-over-QUIC, restrict access to the DoQ service, and monitor for repeated `kresd` worker crashes that could indicate exploitation attempts.
Jul 26, 2026
QNAP disclosed fixes for two vulnerabilities in the **QHora-322** router after public advisories from Trend Micro's Zero Day Initiative linked the bugs to Pwn2Own research by Bongeun Koo and Evangelos Daravigkas of Team DDOS. One flaw, **CVE-2025-62845** (`ZDI-26-240`), affects the `qvpn_db_mgr` endpoint and allows attackers to bypass **QBelt VPN** authentication through improper neutralization of escape sequences in the `role_type` parameter. The issue was rated **CVSS 6.3**. A second flaw, **CVE-2025-62846** (`ZDI-26-241`), also in `qvpn_db_mgr`, stems from improper validation of user input used to build SQL queries, creating a username SQL injection condition that can lead to **remote code execution as root**. ZDI said exploitation nominally requires authentication, but the product's authentication mechanism can be bypassed, making the bugs especially dangerous when chained. QNAP has released updates to remediate the vulnerabilities, and the RCE issue was assigned a **CVSS 8.8** severity score.
Jun 29, 2026