CVE-2026-45290: Cloudburst Network has DoS in RakNet connection handling due to missing bound checks

Synopsis

A denial-of-service vulnerability in Cloudburst Network's RakNet connection handling allows an unauthenticated remote attacker to stall the Netty event loop by sending crafted packets that bypass missing bound checks. The service becomes entirely unresponsive once the event loop is stalled, making it inoperable until restarted. No fix version has been published to upstream registries yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the exposed RakNet service over the network; any publicly accessible host running the affected library is within range.

• AuthenticationNot required

  No credentials or account are needed; the malicious packets can be sent by any unauthenticated party.

• Victim interactionNot required

  No user action is required; the attacker sends packets directly to the service without involving any human on the target side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• Crashes the Netty event loop, rendering the entire affected service inoperable until it is manually restarted.
• All connections handled by the stalled event loop are dropped, cutting off every active client session simultaneously.
• Repeated triggering keeps the service down indefinitely with minimal attacker effort, due to low attack complexity and no authentication barrier.