EUVD-2025-210880
GHSA-j79r-9x96-ppx6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable DoS requiring only authenticated Bedrock session (PR:L); no confidentiality or integrity impact, only server availability (A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.
AnalysisAI
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.
Technical ContextAI
PocketMine-MP (CPE cpe:2.3:a:pmmp:pocketmine-mp:*:*:*:*:*:*:*:*) is a PHP-based Minecraft Bedrock Edition server. During the resource-pack handshake, the client sends a ResourcePackClientResponsePacket with STATUS_SEND_PACKS containing a packIds array of UUIDs it requests. The server iterates this array and for each entry emits a ResourcePackDataInfoPacket. CWE-20 (Improper Input Validation) applies because the server unconditionally trusts the client-supplied array without calling array_unique() or tracking already-sent packs. Official Mojang clients never send duplicate UUIDs, so the assumption of well-behaved clients was never tested against a custom non-standard client.
RemediationAI
Upgrade to PocketMine-MP 5.32.1, which resolves the issue via commits c417ecd30d20520227b15e09eda87db492ab0a6a and e375437439df51f7862b6b98318394643fcd6724. The fix deduplicates the packIds array before processing and disconnects clients that send an excessive number of duplicates. For operators who cannot patch immediately, enabling a server whitelist (restricting connections to trusted players) eliminates the untrusted-client attack surface entirely but blocks new player onboarding. Network-layer rate limiting on the Bedrock port (default UDP 19132) can reduce exposure but will not prevent a single crafted packet from triggering the vulnerability. No configuration toggle exists to disable STATUS_SEND_PACKS processing independently of resource packs.
More in Pocketmine Mp
View allUnauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Mine
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game serv
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server perfo
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consu
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progressio
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today