38435 ★ RecommendedSecurity Server crashes from malformed connection, HTTP and latent-event input2026-11-06 38182 ✓ OKVoice Mumble server network robustness2026-11-02 38004 ✓ OKSecurity Latent event reassembly is now boundedNetwork Network-thread hitches and mass timeouts under reliable-queue pressure2026-10-28 37262 ✓ OKSecurity One client could freeze the server by flooding game eventsSecurity Windows server can hang under weaponDamageEvent flooding2026-10-13 28871 ! Known issueTimeouts from a OneSync frame-backlog change Security Better rate limiting for client latent events2026-04-29 23984 ○ Out of supportSecurity Clients can no longer create multiple player objects2026-01-05 16276 ! Known issueReports of JS failing to load in resources Security New block_net_game_event command2025-06-24 15859 ○ Out of supportVoice Voice server blocks external connections by default2025-06-12 14317 ○ Out of supportSecurity sv_protectServerEntities: stop clients deleting server-created entities2025-04-17 13930 ! Known issueHigh FXServer CPU usage on Linux Voice External voice connections blocked without warning (reverted)2025-03-31 13174 ! Known issueHigh FXServer CPU usage on Linux Security Synchronized scenes on other players' entities are sanitized2025-03-06 12906 ○ Out of supportVoice voip-server-mumble crash from empty voice messages2025-02-14 12739 ○ Out of supportSecurity State bag strict mode (sv_stateBagStrictMode)2025-02-04 11012 ○ Out of supportSecurity Authentication on the /perf and profileData.json endpoints2024-11-13 10188 ○ Out of supportSecurity players.json no longer exposes player identifiers (CVE-2024-46310)2024-10-03 10048 ○ Out of supportSecurity Integer overflow in network component size calculation2024-09-25 9813 ○ Out of supportSecurity rcon_password made read-only2024-09-09 9734 ○ Out of supportSecurity State bag packet validation2024-09-05 9635 ○ Out of supportSecurity Cap on pending latent events per client2024-08-28 8151 ○ Out of supportSecurity Rate limit on array handler updates (msgArrayUpdate)2024-05-14 7776 ○ Out of supportSecurity Network buffer over-read fill bug2024-03-28 7375 ○ Out of supportSecurity Rate limit on large or frequent state bag writes from clientsSecurity Size limit on client endpoint requests (sv_maxClientEndpointRequestSize)2024-01-29 7290 ○ Out of supportSecurity Out-of-bounds read in the connection handshake (current 'critical' floor)2024-01-08 5644 ✕ UnsafeVoice Voice dropouts from too-low Mumble bandwidth limit2022-06-11 5513 ✕ UnsafeSecurity Memory corruption crash in the HTTP/2 server2022-04-24 5506 ✕ UnsafeSecurity sv_filterRequestControl: block entity control requests2022-04-21 5504 ✕ UnsafeVoice Voice server memory exhaustion via channels2022-04-20 5483 ✕ UnsafeVoice Server crash when using MumbleSetPlayerMuted / MumbleIsPlayerMuted2022-04-14 5429 ✕ UnsafeSecurity Rate limiter on the /perf HTTP endpoint2022-03-25 5152 ✕ UnsafeVoice Voice encryption used the wrong key material (upstream uMurmur fix)2022-01-01 5102 ✕ UnsafeSecurity State bag message parsing flaw (urgent update in Dec 2021)2021-12-16 4489 ✕ UnsafeSecurity Connection token required before ENet allocates a peer2021-09-08 957 ✕ UnsafeSecurity Security advisory 2019-01-02: remote console DoS (CVSS 7.5)2019-01-02 923 ✕ UnsafeSecurity Security advisory 2018-12-13: resource/packet handling DoS (CVSS 6.5)2018-12-13 