Threats affecting pkg:github/pmmp/PocketMine-MP

CVE-2026-86204 is a high-severity vulnerability in PocketMine-MP before version 5.39.2. It allows authenticated players to send oversized JSON payloads in ModalFormResponsePacket handling, leading to uncontrolled resource consumption. This can exhaust server memory and CPU, causing denial of service and making the server unresponsive.

CVE-2026-86203 is a vulnerability in PocketMine-MP before version 5.39.2 where the software fails to properly validate the despawn state of entities when processing attack packets. This allows attackers to exploit a race condition by attacking a disconnecting player, triggering multiple death handlers and causing duplication of inventory items and experience points.

CVE-2026-86202 is a medium severity vulnerability in PocketMine-MP before version 5.39.2. It involves insufficient control of network message volume in the handling of ActorEventPacket messages. Attackers can exploit this to trigger consuming animations for all visible players, causing network amplification that wastes server CPU and memory resources.

CVE-2026-86201 is a denial of service vulnerability in PocketMine-MP before version 5.41.1. It arises from improper handling of LoginPacket processing where crafted packets containing large or deeply nested clientData JWT properties cause excessive logging without sanitization. This can lead to out-of-memory conditions and server crashes.

PocketMine-MP before version 5.42.1 has a denial of service vulnerability in its LoginPacket handler. Remote attackers can exploit this by sending login packets containing numerous junk properties in the clientData JWT, causing excessive logging and CPU usage. This can degrade server performance and potentially disrupt service availability.

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

CVE-2026-86198 affects PocketMine-MP versions before 5.44.2 and involves improper validation of multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED during resource pack handling. This flaw allows malicious clients to send multiple such packets, causing duplicate Player objects to be created. The result is amplified memory consumption and increased network traffic. The vulnerability has a low severity score and requires a patch to address the issue.

CVE-2025-71418 is a medium severity vulnerability in PocketMine-MP before version 5.25.2. It involves uncontrolled resource consumption due to lack of limits on the explode() function during packet parsing. Malicious clients can send crafted packets with excessive delimiters to exhaust CPU and memory resources via sign editing, JWT parsing, and command parsing endpoints.

CVE-2025-71417 is a vulnerability in PocketMine-MP before version 5.32.1 where the software fails to validate the uniqueness of pack UUIDs in ResourcePackClientResponsePacket during STATUS_SEND_PACKS handling. This allows authenticated clients to send multiple copies of valid pack UUIDs in a single packet, causing duplicate pack transmissions. The result can be server memory exhaustion leading to denial of service.

PocketMine-MP versions before 5.11.1 contain a denial of service vulnerability in the LoginPacket JSON processing. Remote attackers can send malformed JSON data that triggers improper object initialization from scalar JSON types, causing unset required properties and crashing the server. This vulnerability allows unauthenticated attackers to disrupt service availability.

PocketMine-MP before version 5.11.2 has a denial of service vulnerability caused by improper input validation in the BookEditPacket handling. Specifically, if an attacker sends a BookEditPacket with an inventory slot value greater than 35, it triggers an unhandled exception that crashes the server. This vulnerability allows remote attackers with limited privileges to cause a server crash without user interaction.

PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.