Hi there, guest! If you have an account, then please sign in or register in order to see more.
TeamSpeak 3 Vulnerabilities: Update to 3.13.8
Updated 7 October 2026
6 min read
ESAGAMES Team
TeamSpeak's advisory TS-SA-2026-001 disclosed three High-severity vulnerabilities in TeamSpeak 3 Server 3.13.7 and below. All three are denial-of-service bugs - a remote attacker can crash or restart your voice server, not take it over - and all are fixed in version 3.13.8. Here's the plain-English breakdown and what to do.
Quick answer
TeamSpeak's advisory TS-SA-2026-001 disclosed three high-severity denial-of-service vulnerabilities in TeamSpeak 3 Server 3.13.7 and below: a remote attacker can crash or restart the server, though not take it over. Update every TeamSpeak 3 server to 3.13.8 or newer.
What was actually found (and what wasn't)
First, to clear up the rumours: these are denial-of-service vulnerabilities, not a full "TeamSpeak got hacked" remote-code-execution takeover. In practice an attacker can crash your server or force it to restart with crafted network traffic - disruptive, especially mid-event, but not a way to steal your data or run code on the box. The affected version is 3.13.7 and below (not any 3.17 build), and the fix is 3.13.8.
The three vulnerabilities
CVE-2026-4390 - a use-after-free from inconsistent connection-state handling. An authenticated attacker can trigger a denial-of-service (crash / restart).
CVE-2026-4391 - a heap-based buffer overflow in ECC key parsing. An unauthenticated attacker can crash the server with crafted input.
CVE-2026-4392 - an assertion failure triggered by crafted input, again exploitable by an unauthenticated attacker for denial-of-service.
The two unauthenticated bugs (4391 and 4392) are the more worrying pair, because an attacker needs no credentials at all - just the ability to reach your server's port.
Am I affected?
You're affected if you run TeamSpeak 3 Server 3.13.7 or older (or the TeamSpeak SDK server-side integration below 3.5.0). Check your version in the server log at startup or via the admin query interface. If you're on hosted TeamSpeak, your provider may already have patched - ask them.
What to do
Update TeamSpeak 3 Server to 3.13.8 immediately (SDK users: 3.5.0). This is the real fix.
Back up your files and database (the ts3server.sqlitedb file, or your MySQL database) before upgrading.
If you can't update this minute, restrict who can reach the ports with a firewall while you schedule the upgrade - but patching is the only real fix.
Put the voice server behind DDoS protection, since crash-style attacks and traffic floods often arrive together.
Keeping a voice server healthy
Voice servers are a favourite target because knocking one offline instantly disrupts a community. Beyond patching, the essentials are firewalling the query and voice ports, keeping the server updated, and filtering hostile traffic upstream. Our guide on protecting a TeamSpeak or voice server from DDoS covers the network side, and the game server security checklist covers the rest.
These are crash bugs, not a takeover - but two of them need no login at all. Update to 3.13.8 and put the server behind filtering.
Run TeamSpeak on a protected network
ESAGAMES TeamSpeak hosting stays patched and sits behind multi-Tbps Frankfurt DDoS filtering, so crash bugs and floods don't take your community offline.
It is part of TeamSpeak advisory TS-SA-2026-001, which disclosed three High-severity vulnerabilities in TeamSpeak 3 Server 3.13.7 and below. All three are denial-of-service issues — an attacker can crash or restart your voice server, not take it over.
How do I fix the TeamSpeak 3 server vulnerability?
Update to TeamSpeak 3 Server version 3.13.8, which fixes all three issues. If you are on hosted TeamSpeak, check that your provider has already updated the server build.
Can attackers take over my TeamSpeak server with this bug?
No — these particular issues are denial-of-service only, meaning they can crash or restart the server rather than give an attacker control or access to your data. They still cause real disruption, so patching matters.
BepInEx, QoL, building and content mods — the best Valheim mods to run on a dedicated server this year, with a starter pack and sync rules that stop join failures.
Super Structures, Spyglass, Cryopods and more — the best ARK mods to run on a server this year, with load order and the ASE-vs-ASA differences that trip people up.
SourceMod does not support CS2 — not in 2026, not through a bridge. Here is what actually replaced it.
Action required
Let's talk about privacy.
We use essential cookies to keep checkout, login sessions and security flows working. Optional cookies help us understand performance, remember interface choices and enable external support widgets only when you allow them.
