Description
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | 4.0.0 – < 4.12.3 | 4.12.3 |
References
- GitHub Security Advisory (GHSA-474q-9hgp-hcvx) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions third-party-advisory