EUVD-2026-74912
GHSA-qrr8-c2f6-fmqr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth network reachable DoS with no complexity or privileges; only availability impacted, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
AnalysisAI
Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's var_export() without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the LoginPacket is processed during the connection-establishment phase before any authentication or session state exists, so unauthenticated actors with network access to the Minecraft Bedrock port (default UDP 19132) can trigger the crash directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately characterizes the threat: remote, unauthenticated, low-complexity, fully automatable availability destruction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PocketMine-MP 5.41.1 or later (Composer: composer require pocketmine/pocketmine-mp:^5.41.1), which is the vendor-confirmed fix per GHSA-h6rj-3m53-887h and commit 87d1c0c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PocketMine-MP deployments and identify which instances are internet-accessible or reachable from untrusted networks; escalate production instances for expedited remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pocketmine Mp
View allUnauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game serv
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server perfo
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consu
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progressio
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today