Missing bounds checks in the connection handshake, the HTTP request parser and latent event reassembly could crash the server when it received crafted data. Anyone who can reach the server's port could trigger it. Update to 38435 or newer.
Before 37262 there was no core rate limit on netGameEvent packets. A single client could flood events such as weaponDamageEvent until the main thread hung and txAdmin restarted the server. The issue was reported on 35636 and 36727. 37262 drops clients that go over the new 'netGameEvent' rate limiter.
The server's reassembly of large client-to-server latent events got hard limits, plus diagnostics for 'latent ACK overflow'. Older builds let a client keep more partial event state than they needed to, which costs memory and CPU.
Rate limiting of latent (TriggerLatentServerEvent) traffic from clients was tightened in the reassembly packet handler. On older builds a client could push latent event traffic harder than intended.
Before 9635 a client could keep an unlimited number of unfinished latent events open on the server. They are now capped at 100 by default. The cap is set with sv_netEventReassemblyMaxPendingEvents, and sv_netEventReassemblyUnlimitedPendingEvents turns it off.
With OneSync, a modified client could register more than one networked player object (CNetObjPlayer) for itself. That is a known abuse path for desync and crashes. Since 23984 the server rejects the extra ones.
Server owners can now block specific net game event types from clients with block_net_game_event (and undo it with unblock_net_game_event). Use it when an event type is being abused. The syntax was simplified in 16541.
This new replicated convar (default off) protects entities created by server scripts from being deleted by clients. If cheaters delete your server-spawned vehicles, peds or props, run 14317 or newer and set sv_protectServerEntities true.
The server now checks network synchronized scenes started by a client on entities that client does not own, a common way to force animations on other players. 13174 also adds SET/GET_ENTITY_REMOTE_SYNCED_SCENES_ALLOWED to control this per entity.
With setr sv_stateBagStrictMode true, clients can no longer change replicated state bags at all. Only the server can write them. Turn it on if your scripts never need client-written state bags, because cheaters commonly abuse them.
Before 7375 the server accepted client state bag updates without limits. A client could exhaust server memory or use state bags to blast data to everyone else. Limits are now applied, and you can lower them with rateLimiter_stateBagSize_rate and rateLimiter_stateBagSize_burst.
Validation of incoming state bag packets was tightened, so malformed client packets are rejected before they are processed. Older builds accept more malformed input.
An invalid ticket length during initConnect could make the server read out of bounds. Anyone connecting could trigger it. 7290 is still the 'critical' minimum build in Cfx.re's version API, so nothing older should ever be run.
The public /players.json endpoint used to list every player's identifiers (license, Steam, Discord and so on) to anyone. That is the issue tracked as CVE-2024-46310, which names v9601 and earlier. Since 10188 identifiers are hidden unless you set sv_exposePlayerIdentifiersInHttpEndpoint true, and sv_playersToken can restrict the endpoint.
The server's performance and profiler HTTP endpoints could be read without credentials. As part of 'TCP endpoint hardening', /perf now uses basic auth and profileData.json needs a token. Older builds expose this internal data to anyone who knows the URL.
rcon_password was made a read-only convar to prevent misuse, such as a resource changing the remote console password at runtime. If you still use RCON, use 9813 or newer.
A size calculation in the shared network code could overflow when given unexpected values, which can lead to memory errors. It was fixed in 10048.
When network code read past the end of a buffer, only a few bytes of the output were cleared, so the rest held leftover memory. Fixed in 7776.
Clients could send array update packets without any rate limit. 8151 added one, which closes a flooding vector.
The parsing of POST bodies sent to the client HTTP endpoints changed, and a maximum request size was added (sv_maxClientEndpointRequestSize). Oversized requests no longer cost the server memory and CPU.
A reported memory corruption crash in the built-in HTTP/2 server was mitigated. The 5562 recommended announcement lists it under security.
This new convar lets the server block clients' 'request control' events, which are commonly abused to take over other players' entities. It defaults to off for compatibility, so you need to set it yourself.
The Mumble server didn't free channel names, descriptions and passwords. A malicious client could keep creating and leaving channels until the server ran out of memory. Fixed in 5504. The 5848 recommended release notes that several Mumble DoS and memory exhaustion exploits were fixed.
The default max bandwidth per voice client was raised, which fixed some players losing voice. The listener limit was also raised to 256.
Oversized or invalid outgoing voice messages used to hit an assertion. They are now dropped cleanly, and the send queue is drained properly. The voice server should be less likely to stall or crash under bad traffic.
