QTI Neon’s version 1.0.0 contains a flaw in the handleReconnectRequest function: it forwards RECONNECT_REQUEST packets from clients to the host without imposing any size limits. An unauthenticated attacker can therefore send a large number of requests, causing the host to process them as if they were legitimate and consume resources until the host becomes unavailable. This issue is a classic example of unbounded input leading to resource exhaustion and is reflected in CWE‑400 (Uncontrolled Resource Consumption), CWE‑406 (Untrusted Input Not Checked for Size) and CWE‑770 (Allocation of Excessive Resources). The resulting denial of service can affect any instance of the relay that accepts incoming RECONNECT_REQUEST packets, potentially disrupting multiplayer games or other services that rely on the library.

The vulnerability affects Quiet‑Terminal‑Interactive’s QTINeon library, version 1.0.0. No other versions or products have been identified as affected by the reviewed data.

The CVSS score of 8.6 indicates a high severity. The EPSS score is below 1 %, suggesting that exploitation attempts are expected to be rare, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is most likely network‑based over UDP, where an unauthenticated client can send arbitrary RECONNECT_REQUEST packets to the relay without needing any authentication token or other credentials. Once the relay forwards the packet to the host, the amplification of traffic can overwhelm the host’s resources, leading to a denial of service. No fix is currently available, so the risk remains until a patch is released or a workaround is applied.