CVE-2025-71418: Uncontrolled Resource Consumption in pmmp PocketMine-MP
Affects pmmp PocketMine-MPSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| pmmpPocketMine-MP | Affected
| Fixed in
|
GitHub Actionspmmp/PocketMine-MPpkg:github/pmmp/PocketMine-MPOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in PocketMine-MP version 5.25.2. Users should upgrade to version 5.25.2 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary as the issue is resolved by the official patch.
Description
CVE-2025-71418 is a medium severity vulnerability in PocketMine-MP before version 5.25.2. It involves uncontrolled resource consumption due to lack of limits on the explode() function during packet parsing. Malicious clients can send crafted packets with excessive delimiters to exhaust CPU and memory resources via sign editing, JWT parsing, and command parsing endpoints.
Impact
Attackers can cause denial of service or significant performance degradation on affected PocketMine-MP servers by sending specially crafted packets that exploit the uncontrolled resource consumption vulnerability. This impacts server availability and resource stability but does not require authentication or user interaction.
Summary
PocketMine-MP versions prior to 5.25.2 do not properly limit the usage of the explode() function when parsing packets. This allows attackers to craft packets containing excessive delimiters, which leads to excessive CPU and memory consumption during processing of sign editing, JWT parsing, and command parsing. This uncontrolled resource consumption can degrade server performance or cause denial of service conditions.