CVE-1999-1066: Quake 1 server responds to an initial UDP game connection request with a large amount of traffic, which all...

Security readout for executives and security teams

This CVE describes an old Quake 1 server behavior that can turn the server into a traffic amplifier. An attacker could spoof a victim’s address, send a small UDP game connection request, and cause the server to send larger traffic toward the victim. The main risk is third-party denial-of-service abuse from exposed legacy game servers. Exposure is likely limited to Internet-reachable Quake 1 servers or legacy systems running compatible server software. The source bundle does not provide affected versions or CPEs, so asset validation is required before assuming exposure. Treat this as a legacy exposure cleanup item unless an Internet-facing Quake 1 server exists. If found, prioritize containment because the business risk is reputational and operational impact from being abused in denial-of-service traffic. Mitigation focus: Inventory and remove any unnecessary public Quake 1 server instances.; Restrict inbound UDP access to required sources where the service must remain available.; Check vendor or maintainer guidance for corrected builds or safe configuration..

Prepared

Jul 1, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.