CS 1.6 Server Crash Exploit Fix – Safe Userinfo AMXX Plugin

Last updated: October 2, 2026

Safe Userinfo (version 1.4 by the_hunter) is an AMX Mod X plugin that fixes the userinfo exploit on counter-strike 1.6 servers. A malicious player sends a broken userinfo string, the server passes it on, and every connected player gets disconnected with an svc_bad error. The attack works even on servers with the latest ReHLDS and ReGameDLL.

The plugin checks every player’s userinfo and kicks the player before the bad data can reach anyone else. Below: CS 1.6 safe userinfo download, installation and how to recognize the attack.

Safe userinfo amxx download

Download Counter-Strike Safe Userinfo 1.4 (.ZIP)

The ZIP contains userinfo.amxx and the userinfo.sma source.

Install cs 1.6 safe userinfo server crash fix

Requires AMX Mod X with the ReAPI module.

1. Extract the ZIP
2. Upload userinfo.amxx to cstrike/addons/amxmodx/plugins/
3. Add userinfo.amxx on a new line in cstrike/addons/amxmodx/configs/plugins.ini
4. Restart the server and check with amx_plugins that it is running

The plugin has no cvars or commands – it works as soon as it is loaded.

svc_bad and “sent too much data” – signs of the userinfo exploit

When the attack hits, all players are dropped at once and see errors like these in their console:

Host_Error: CL_ParseServerMessage: Illegible server message - svc_bad
Host_Error: DispatchUserMsg: User Msg ItemPickup/93 sent too much data

Before the error the console often shows a list of messages ending with BAD: 255:svc_bad. If many players on your server report illegible server message svc_bad at the same moment, someone is using this exploit.

How the userinfo exploit works

Userinfo is the data each player sends to the server – name, model, rates and other settings. The attacker puts invalid data into it, for example Unicode control characters or broken byte sequences. The server engine does not reject it and sends it on to the other players. Their game cannot read it, so every client stops with a Host_Error and disconnects.

How safe userinfo blocks the attack

• Checks the userinfo of every player when they connect and when they change their info
• Accepts only valid UTF-8 text without harmful characters
• Kicks the player with the message “Invalid userinfo” if the check fails
• Normal players are not affected – only invalid userinfo is blocked

Safe userinfo not working – what to check

• Plugin shows as “bad load”: ReAPI is not installed or not running. Type amxx modules – ReAPI must be listed
• Players still get svc_bad: make sure the plugin is running. svc_bad can also come from other causes, such as a broken plugin or a mod that sends too much data – check the server console for errors
• A normal player gets “Invalid userinfo”: their name or settings contain unusual characters. Ask them to change their name

For more server protection see Block Wallhack v8 and why people DDoS and exploit cs 1.6 servers. More tools: cs 1.6 admin commands list. Players without the game can get the CS 1.6 download here.