PyPI/qti-neon CVE-2026-54609: high 8.6, EPSS 0.46%
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
Action: No fix published. Pin and monitor.
Affected
No affected ranges in the source.
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-85rg-p3fr-xc2f
- https://github.com/Quiet-Terminal-Interactive/QTINeon/security/advisories/GHSA-85rg-p3fr-xc2f
- https://github.com/Quiet-Terminal-Interactive/QTINeon
CVE-2026-54609 · published · modified · JSON