PocketMine-MP versions prior to 5.44.2 have a vulnerability during the resource pack stage of client login. A malicious client can send multiple ResourcePackClientResponsePacket packets with a completed status, causing the server to repeatedly execute pre-spawn progression. This leads to the creation of multiple Player objects for a single session, increasing memory usage and outbound network traffic due to duplicated large pre-spawn packets. The issue was patched in version 5.44.2.