CVE-2010-5077: IOQUAKE3 Engine

High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days.

server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.

Affected products

• IOQUAKE3 IOQUAKE3 Engine: up to and including r1761
• Openarena Openarena: any version
• Tremulous Tremulous: any version

Published 2014-10-27. Last modified 2026-06-16.