Live › vulnerability › GHSA-pg53-p7qp-65cv
A malicious Minecraft Bedrock client can send a batch of resource pack completion packets during login, causing the server to run pre-spawn setup repeatedly. This creates extra Player objects for one session, increasing memory use and outbound network traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:33 UTC. All times on this page are UTC.
Operators of PocketMine-MP Minecraft Bedrock servers running a version before 5.44.2 are exposed, since any connecting client can trigger the repeated login processing. Plugins that register their own PacketHandler can mitigate it by ignoring extra ResourcePackClientResponsePacket packets, as the advisory describes. Servers running other software or not exposing PocketMine-MP to clients can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pocketmine/pocketmine-mp | composer | < 5.44.2 | 5.44.2 |
composer show pocketmine/pocketmine-mp and compare against 5.44.2.pocketmine/pocketmine-mp in composer.lock for the installed version.pocketmine/pocketmine-mp to 5.44.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.
Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.
Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
This page as .md · .json · in your agent: get_signal("GHSA-pg53-p7qp-65cv")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.