Pmmp
Monthly
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game server unresponsive by sending a ModalFormResponsePacket with an arbitrarily large JSON payload. The server processes incoming form response data without enforcing any size limit, enabling an attacker to exhaust server memory and CPU with JSON arrays containing millions of elements. A public proof-of-concept Node.js script is confirmed in vendor advisory GHSA-788v-5pfp-93ff; no public exploit identified at time of analysis in CISA KEV.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's `var_export()` without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. A publicly available proof-of-concept is referenced in the vendor's GitHub Security Advisory (GHSA-g2fj-p69p-9chp); no CISA KEV listing is confirmed at time of analysis.
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race condition during another player's disconnection, causing inventory loot and XP to drop multiple times from a single death event. The InGamePacketHandler fetches entities via World->getEntity() without validating the flaggedForDespawn state, so the death handler can fire multiple times for the same disconnect-death event if a crafted attack packet arrives within the narrow timing window. A detailed proof-of-concept with exact reproduction steps is publicly available via the vendor's GitHub Security Advisory; vendor patch 5.39.2 is available and no KEV listing exists.
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consuming animations for all visible players by sending crafted ActorEventPacket messages. Each malicious packet causes the server to invoke ConsumingItemAnimation.broadcastAnimation() for every peer in range, multiplying network load and CPU/memory consumption proportionally to the online player count. A publicly available proof-of-concept exists via the GitHub security advisory; no active exploitation has been confirmed in CISA KEV.
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server performance by sending LoginPackets whose clientData JWT bodies contain large numbers of arbitrary junk properties. The server's JsonMapper iterates over and logs a warning for every unexpected property, enabling log flooding and unbounded CPU waste with no authentication required. A publicly available proof-of-concept exists via the vendor's own GitHub security advisory; no active exploitation in the CISA KEV has been reported.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability by submitting crafted packets containing excessive delimiter characters across sign editing, JWT login, and command parsing endpoints. The root cause is PHP `explode()` being called without a limit parameter in multiple packet-handling paths, causing the server to allocate unbounded memory arrays proportional to delimiter count in attacker-controlled input. No CISA KEV listing exists, but a proof-of-concept is publicly available via the vendor's GitHub security advisory (GHSA-g274-c6jj-h78p); vendor assessment notes real-world impact is partially mitigated by existing packet decompression size limits already enforced upstream.
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game server unresponsive by sending a ModalFormResponsePacket with an arbitrarily large JSON payload. The server processes incoming form response data without enforcing any size limit, enabling an attacker to exhaust server memory and CPU with JSON arrays containing millions of elements. A public proof-of-concept Node.js script is confirmed in vendor advisory GHSA-788v-5pfp-93ff; no public exploit identified at time of analysis in CISA KEV.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's `var_export()` without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. A publicly available proof-of-concept is referenced in the vendor's GitHub Security Advisory (GHSA-g2fj-p69p-9chp); no CISA KEV listing is confirmed at time of analysis.
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race condition during another player's disconnection, causing inventory loot and XP to drop multiple times from a single death event. The InGamePacketHandler fetches entities via World->getEntity() without validating the flaggedForDespawn state, so the death handler can fire multiple times for the same disconnect-death event if a crafted attack packet arrives within the narrow timing window. A detailed proof-of-concept with exact reproduction steps is publicly available via the vendor's GitHub Security Advisory; vendor patch 5.39.2 is available and no KEV listing exists.
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consuming animations for all visible players by sending crafted ActorEventPacket messages. Each malicious packet causes the server to invoke ConsumingItemAnimation.broadcastAnimation() for every peer in range, multiplying network load and CPU/memory consumption proportionally to the online player count. A publicly available proof-of-concept exists via the GitHub security advisory; no active exploitation has been confirmed in CISA KEV.
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server performance by sending LoginPackets whose clientData JWT bodies contain large numbers of arbitrary junk properties. The server's JsonMapper iterates over and logs a warning for every unexpected property, enabling log flooding and unbounded CPU waste with no authentication required. A publicly available proof-of-concept exists via the vendor's own GitHub security advisory; no active exploitation in the CISA KEV has been reported.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability by submitting crafted packets containing excessive delimiter characters across sign editing, JWT login, and command parsing endpoints. The root cause is PHP `explode()` being called without a limit parameter in multiple packet-handling paths, causing the server to allocate unbounded memory arrays proportional to delimiter count in attacker-controlled input. No CISA KEV listing exists, but a proof-of-concept is publicly available via the vendor's GitHub security advisory (GHSA-g274-c6jj-h78p); vendor assessment notes real-world impact is partially mitigated by existing packet decompression size limits already enforced upstream.