Which artifact fixed what
Security, voice and network fixes in FXServer. If your build is below the fix, your server is still exposed.
Security
Server crashes from malformed connection, HTTP and latent-event input
Missing bounds checks in the connection handshake, the HTTP request parser and latent event reassembly could crash the server when it received crafted data. Anyone who can reach the server's port could trigger it. Update to 38435 or newer.
Voice
Mumble server network robustness
Oversized or invalid outgoing voice messages used to hit an assertion. They are now dropped cleanly, and the send queue is drained properly. The voice server should be less likely to stall or crash under bad traffic.
Security
Latent event reassembly is now bounded
The server's reassembly of large client-to-server latent events got hard limits, plus diagnostics for 'latent ACK overflow'. Older builds let a client keep more partial event state than they needed to, which costs memory and CPU.
Network
Network-thread hitches and mass timeouts under reliable-queue pressure
On recent recommended builds, servers saw network and sync thread hitches and mass 'Timed out after 60 seconds' disconnects (GitHub #4244). 38004 bundles several fixes: ENet stops scanning the reliable queue when the window is full, latent event fragments go out as unreliable fragments, and the sync code keeps frames based on client silence. One user still reported timeouts on 38004, and 38164 adds a related backlog fix.
Security
One client could freeze the server by flooding game events
Before 37262 there was no core rate limit on netGameEvent packets. A single client could flood events such as weaponDamageEvent until the main thread hung and txAdmin restarted the server. The issue was reported on 35636 and 36727. 37262 drops clients that go over the new 'netGameEvent' rate limiter.
Security
Windows server can hang under weaponDamageEvent flooding
Network
Timeouts from a OneSync frame-backlog change
A OneSync 'improvements' change in 28814 removed the larger frame backlog kept for clients that had been silent for more than 5 seconds. It was rolled back in 31602 'to fix timeout issue'. Avoid 28814 to 31550 if players are timing out.
Security
Better rate limiting for client latent events
Rate limiting of latent (TriggerLatentServerEvent) traffic from clients was tightened in the reassembly packet handler. On older builds a client could push latent event traffic harder than intended.