HIGH 8.6 GitHub
CVE-2026-54609
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
### Impact
The relay's reconnect handler forwards every `RECONNECT_REQUEST` to the host without deduplication or a size cap on the `pendingReconnects` map, unlike the connect flow which guards against this with `maxPendingConnections`. An unauthenticated attacker who knows a valid session ID can send `RECONNECT_REQUEST` packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter as
Affected Products
- maven/com.quietterminal:qti-neon = 1.0.0
- pip/qti-neon = 1.0.0
- npm/qti-neon = 1.0.0
References
- https://github.com/advisories/GHSA-85rg-p3fr-xc2f
- https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-x
- https://github.com/advisories/GHSA-85rg-p3fr-xc2f
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-07-28 via GitHub. Affected: maven/com.quietterminal:qti-neon = 1.0.0, pip/qti-neon = 1.0.0, npm/qti-neon = 1.0.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.