Ongoing outgoing DoS activity - replay UPD attack

TeamSpeak 3 Server
,
1

Hello,

we were contacted by our hosting provider, regarding an abuse report regarding outgoing traffic from our TeamSpeak server.

The TeamSpeak 3 server is already running the latest version 3.13.8, but the issue still occurred.

Is it known to you that your fix from the May 27, 2026 (TS-SA-2026-001) isn’t restricting the vulnerability?

If the server logs or abuse reports are needed, I am happy to provide them.

I have already made a support ticket, but was asked to post it here.

Thank you and best regards,
Florian

2

Thanks for the report, I’ve forwarded it to the devs and will very likely get you an update regarding this issue tomorrow.

3 Likes
3

I’ve heard back and this described behavior is not in correlation with the mentioned CVE and you are rather facing a replay attack through UDP.

With our current architecture we’re unable to provide any fix for TeamSpeak 3 servers, however we want to prevent this behavior with future TeamSpeak 6 servers. No ETA yet.

2 Likes
4

Thank you for your answer.

With your reply, I now have two new questions:

  1. how does TeamSpeak expect users to safely host TeamSpeak 3 servers, when this vulnerability exists?
  2. how would you expect us to host our server now?

TS6 servers are still in beta, and we would like to host a reliable server, like TS3 always was.

5

Just to clarify, this is not really a vulnerability in the TeamSpeak 3 server itself that can simply be patched. What you are seeing is a replay/amplification pattern that can happen with UDP-based communication in certain network setups.

Because of that, the mitigation is usually not something that can be solved inside the application alone. It needs to be handled at the infrastructure or network level. In practice, this means things like using a hosting provider with proper anti-DDoS and anti-spoofing protection, applying firewall rules or rate limits where possible, and working with your provider so they can trace and filter the traffic upstream.

We also provide a Linux netfilter module that may help in these cases:

For current TS3 deployments, the server should ideally run in an environment where the network layer provides protection against these kinds of traffic patterns.

If you keep receiving abuse reports, your hosting provider should be the right point of contact, as they are usually best positioned to help mitigate this on their side.

5 Likes