CVE-2004-2597
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP...
CVE-2004-2597 is a medium vulnerability (CVSS 5.0) in Id Software Quake Ii Server, published December 31, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. No source names a fixed version.
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
Exploit likelihood
What each source reports
NVD Score used
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
- Record
CVE-2004-2597- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
- Record
CVE-2004-2597- Updated
- 2026-11-02
EUVDEUVD-2004-2588 No score
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
- Record
EUVD-2004-2588- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gr4-pm92-g66w No score
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP...
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
- Record
GHSA-5gr4-pm92-g66w- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |