What is the CVSS score of CVE-2026-54609?

CVE-2026-54609 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-54609?

Yes, a public proof-of-concept exploit is available for CVE-2026-54609. Prioritise patching immediately. EPSS: 0.3%.

Qtineon CVE-2026-54609

EUVD-2026-49905 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-28 GitHub_M

GHSA-85rg-p3fr-xc2f

Denial Of Service Qtineon

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 17:17 vuln.today

Analysis Generated

Jul 28, 2026 - 17:17 vuln.today

CVE Published

Jul 28, 2026 - 16:36 cve.org

HIGH 8.6

DescriptionCVE.org

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

AnalysisAI

QTI Neon's relay service amplifies RECONNECT_REQUEST packets to the host, enabling unauthenticated attackers to cause denial of service on the host. The vulnerable handleReconnectRequest function in all three implementations (Java, Python, TypeScript) forward every request without bounding or deduplication, bypassing per-source rate limiting via spoofed IPs. No public exploit or KEV listing exists, but the attack is trivial to execute if a valid session ID is known.