Security, voice and network fixes in FXServer. If your build is below the fix, your server is still exposed.
Missing bounds checks in the connection handshake, the HTTP request parser and latent event reassembly could crash the server when it received crafted data. Anyone who can reach the server's port could trigger it. Update to 38435 or newer.
Oversized or invalid outgoing voice messages used to hit an assertion. They are now dropped cleanly, and the send queue is drained properly. The voice server should be less likely to stall or crash under bad traffic.
The server's reassembly of large client-to-server latent events got hard limits, plus diagnostics for 'latent ACK overflow'. Older builds let a client keep more partial event state than they needed to, which costs memory and CPU.
On recent recommended builds, servers saw network and sync thread hitches and mass 'Timed out after 60 seconds' disconnects (GitHub #4244). 38004 bundles several fixes: ENet stops scanning the reliable queue when the window is full, latent event fragments go out as unreliable fragments, and the sync code keeps frames based on client silence. One user still reported timeouts on 38004, and 38164 adds a related backlog fix.
Before 37262 there was no core rate limit on netGameEvent packets. A single client could flood events such as weaponDamageEvent until the main thread hung and txAdmin restarted the server. The issue was reported on 35636 and 36727. 37262 drops clients that go over the new 'netGameEvent' rate limiter.
A OneSync 'improvements' change in 28814 removed the larger frame backlog kept for clients that had been silent for more than 5 seconds. It was rolled back in 31602 'to fix timeout issue'. Avoid 28814 to 31550 if players are timing out.
Rate limiting of latent (TriggerLatentServerEvent) traffic from clients was tightened in the reassembly packet handler. On older builds a client could push latent event traffic harder than intended.
With OneSync, a modified client could register more than one networked player object (CNetObjPlayer) for itself. That is a known abuse path for desync and crashes. Since 23984 the server rejects the extra ones.
Server owners can now block specific net game event types from clients with block_net_game_event (and undo it with unblock_net_game_event). Use it when an event type is being abused. The syntax was simplified in 16541.
Before 15859 anyone could connect to the built-in Mumble (voice) server, even without being a player on the game server. Now mumble_allowExternalConnections defaults to false, and voice clients must match a connected player who has finished routing. Set it to true only if you deliberately use an external Mumble client.
14583 changed net event latency units to nanoseconds, and several server owners then reported timeouts. 14901 switched back to milliseconds.
This new replicated convar (default off) protects entities created by server scripts from being deleted by clients. If cheaters delete your server-spawned vehicles, peds or props, run 14317 or newer and set sv_protectServerEntities true.
Builds 13759 to 13890 shipped the first version of the external Mumble block, which broke setups that use external voice clients. It was reverted in 13930 and came back in a safer form in 15859.
The server now checks network synchronized scenes started by a client on entities that client does not own, a common way to force animations on other players. 13174 also adds SET/GET_ENTITY_REMOTE_SYNCED_SCENES_ALLOWED to control this per entity.
The server accepted empty Mumble messages from clients, which could crash FXServer in voip-server-mumble (GitHub #3054, reported on 12180). Since 12906 a message must carry at least one byte.
With setr sv_stateBagStrictMode true, clients can no longer change replicated state bags at all. Only the server can write them. Turn it on if your scripts never need client-written state bags, because cheaters commonly abuse them.
The server's performance and profiler HTTP endpoints could be read without credentials. As part of 'TCP endpoint hardening', /perf now uses basic auth and profileData.json needs a token. Older builds expose this internal data to anyone who knows the URL.
10268 turned on the experimental state bag, population and net game event v2 handlers by default, and some servers crashed or had trouble downgrading. 10367 turned net game event v2 back off by default. It was enabled by default again in 16973, after more work.
The public /players.json endpoint used to list every player's identifiers (license, Steam, Discord and so on) to anyone. That is the issue tracked as CVE-2024-46310, which names v9601 and earlier. Since 10188 identifiers are hidden unless you set sv_exposePlayerIdentifiersInHttpEndpoint true, and sv_playersToken can restrict the endpoint.
A size calculation in the shared network code could overflow when given unexpected values, which can lead to memory errors. It was fixed in 10048.
rcon_password was made a read-only convar to prevent misuse, such as a resource changing the remote console password at runtime. If you still use RCON, use 9813 or newer.
Validation of incoming state bag packets was tightened, so malformed client packets are rejected before they are processed. Older builds accept more malformed input.
Before 9635 a client could keep an unlimited number of unfinished latent events open on the server. They are now capped at 100 by default. The cap is set with sv_netEventReassemblyMaxPendingEvents, and sv_netEventReassemblyUnlimitedPendingEvents turns it off.
TCP connections that send or receive nothing are now closed after sv_tcpConnectionTimeoutSeconds (default 5 s), with extra time while an HTTP handler runs (sv_httpHandlerConnectionTimeoutSeconds). Before 8883, idle connections could stay open and hold server resources.
Clients could send array update packets without any rate limit. 8151 added one, which closes a flooding vector.
When network code read past the end of a buffer, only a few bytes of the output were cleared, so the rest held leftover memory. Fixed in 7776.
Before 7375 the server accepted client state bag updates without limits. A client could exhaust server memory or use state bags to blast data to everyone else. Limits are now applied, and you can lower them with rateLimiter_stateBagSize_rate and rateLimiter_stateBagSize_burst.
The parsing of POST bodies sent to the client HTTP endpoints changed, and a maximum request size was added (sv_maxClientEndpointRequestSize). Oversized requests no longer cost the server memory and CPU.
An invalid ticket length during initConnect could make the server read out of bounds. Anyone connecting could trigger it. 7290 is still the 'critical' minimum build in Cfx.re's version API, so nothing older should ever be run.
The default max bandwidth per voice client was raised, which fixed some players losing voice. The listener limit was also raised to 256.
A reported memory corruption crash in the built-in HTTP/2 server was mitigated. The 5562 recommended announcement lists it under security.
This new convar lets the server block clients' 'request control' events, which are commonly abused to take over other players' entities. It defaults to off for compatibility, so you need to set it yourself.
The Mumble server didn't free channel names, descriptions and passwords. A malicious client could keep creating and leaving channels until the server ran out of memory. Fixed in 5504. The 5848 recommended release notes that several Mumble DoS and memory exhaustion exploits were fixed.
Calling these mute natives could crash FXServer from time to time. Fixed in 5483.
Requests to /perf could be spammed. 5429 added the http_perf rate limiter, and it shipped to the recommended channel in 5562.
The built-in uMurmur server set up its voice encryption key from the wrong value and sent back the wrong nonce on resync. 5152 applies the upstream uMurmur fix.
A client-sent state bag message with empty or out-of-range data was parsed unsafely. The commit was flagged as urgent ('update pls'). Builds before 5102 are exposed.
New players were sent every state bag on the server, not just the relevant ones. That wasted bandwidth and slowed joins on busy servers. Fixed in 5077.
Fake peers could spam UDP connection attempts and tie up server resources without ever finishing a real connection. Since 4489 a token derived from the connection is checked before a peer is allocated, and 4492 also limits token reuse.
Remote console packet parsing could be crashed by an unauthenticated remote attacker, and Cfx.re reported it was being exploited in the wild. The Windows fix is 957. Linux got a separate hotfix build, and normal master builds worked again from 960.
A flaw in resource handling and network packet parsing let a remote attacker crash the server, and it was being exploited in the wild. Fixed in 923.
