EUVD-2026-74910
GHSA-vmpr-x88w-pmm6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth required; crash is server-local with no scope change; pure availability impact, no confidentiality or integrity loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
AnalysisAI
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target server to be running in offline authentication mode, which accepts self-signed JWT certificate chains without Xbox Live verification - this is the default for many community and LAN servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) accurately characterizes this as a trivially exploitable, zero-barrier denial-of-service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade PocketMine-MP to version 5.43.1 or later - this is the vendor-released patch that resolves the Certificate validation flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately identify and catalog all PocketMine-MP servers in production, noting current version numbers and identifying those running pre-5.43.1 releases. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pocketmine Mp
View allUnauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Mine
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game serv
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server perfo
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consu
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progressio
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today