Description
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 5.43.1 | 5.43.1 |
References
- GitHub Security Advisory (GHSA-g2fj-p69p-9chp) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login third-party-advisory