PocketMine-MP EUVD-2025-210880

Requires: (1) A completed authenticated Bedrock session - the attacker must connect to the server and pass normal login/authentication (PR:L). (2) At least one resource pack configured on the server - if the server has no resource packs, the STATUS_SEND_PACKS phase is not reached. (3) A custom non-standard Bedrock client capable of sending duplicate UUIDs in the packIds array - official Mojang clients never produce this packet. Limiting factors: server whitelisting prevents unauthenticated/unknown players from reaching the vulnerable code path; the server must be reachable on its Bedrock network port.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) scores 7.1, accurately reflecting that authentication is required (PR:L - the attacker must complete the Bedrock session handshake) but complexity is low thereafter. The amplification characteristic is the key risk multiplier: a single packet with thousands of duplicate UUIDs can trigger disproportionate server-side memory allocation before the process crashes. No EPSS data was provided and the vulnerability is not in CISA KEV, but publicly available exploit details in the GHSA advisory mean the barrier to exploitation is low for anyone operating a custom Bedrock client. The practical risk is highest for public PocketMine-MP servers accessible to untrusted players; private servers with whitelisted player lists face significantly reduced exposure.

An attacker runs a custom Minecraft Bedrock client, connects to a public PocketMine-MP server, and completes the normal authentication handshake. After authentication, the attacker sends a single crafted ResourcePackClientResponsePacket with STATUS_SEND_PACKS containing several thousand copies of a valid resource pack UUID. The server faithfully processes each duplicate, allocating memory and preparing ResourcePackDataInfoPacket transmissions until the PHP process exhausts available RAM and terminates. GHSA-fqqv-56h5-f57g contains sufficient technical detail to implement this attack.