GitHub Advisoryadvisory · Packagist

GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

LOW Published 2026-10-29 Modified 2026-10-29 Official page ↗
Ecosystem
Packagist
Packages
pocketmine/pocketmine-mp
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-837
Reviewed
2026-10-29

Affected packages

• Packagist pocketmine/pocketmine-mp: < 5.44.2 → fixed in 5.44.2

Description

Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`. Workarounds Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets. Patches This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

Related

Weakness · CWE (1)

  • CWE-837 Improper Enforcement of a Single, Unique Action weakness

References