Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Godot 4.x spawn-packet bug can remotely crash multiplayer clients

1 source · 2 articlesFirst reported Updated ()3
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Godot 4.x multiplayer spawn-packet bounds check can remotely crash clients; no patched version has been named.

Tomasz Kaye disclosed on October 27 a remote denial-of-service flaw in Godot 4.x multiplayer. Godot 4.0.0 through 4.7.2 and current master are affected. The failing bounds check on sync_len is in SceneReplicationInterface::on_spawn_receive, cited at scene_replication_interface.cpp line 586, and was introduced in commit 32a62af648 on October 3, 2022. Kaye runtime-confirmed it on the official 4.7-stable Windows binary. No patched version is named.

Key facts
  • Affects Godot 4.0.0 through 4.7.2 and current master.
  • Vulnerable check added in commit 32a62af648 on October 3, 2022.
  • Confirmed on the official 4.7-stable Windows binary.
  • Cited at scene_replication_interface.cpp line 586.
  • No patch version is named.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 3, 2022Vulnerable spawn-packet bounds check added in commit 32a62af648. · oss-security
  2. Oct 27, 2026Tomasz Kaye discloses remote Godot multiplayer client crash. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityNames affected range, commit, confirmation binary, and source line.
Vendors
Godot

Coverage

oldest first · one row per article · UTC
  1. · 14d ago oss-securityFirst report

    Godot 4.0.0–4.7.2 remote crash via spawn-packet overflow

    A bounds check in SceneReplicationInterface::on_spawn_receive fails on sync_len; no patch version is named.

  2. · 14d ago oss-security

    Godot 3.2.2–4.7.2 remote crash via DTLS heap overflow

    DTLS is opt-in; the flaw was runtime-confirmed on the official 4.7-stable Windows release template, with no fix named.