Description
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 5.44.2 | 5.44.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 5.44.2 | 5.44.2 | GHSA-pg53-p7qp-65cv |
References
- GitHub Security Advisory (GHSA-pg53-p7qp-65cv) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket third-party-advisory