{"id":"GHSA-pg53-p7qp-65cv","kind":"vulnerability","aliases":["GHSA-pg53-p7qp-65cv"],"related":[],"title":"PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets","description":"### Summary\nDuring the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression.\n\n###  Impact\nMultiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.\n\n### Workarounds\nPlugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets.\n\n### Patches\nThis issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.","summary":"A malicious Minecraft Bedrock client can send a batch of resource pack completion packets during login, causing the server to run pre-spawn setup repeatedly. This creates extra Player objects for one session, increasing memory use and outbound network traffic.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pocketmine/pocketmine-mp","fixed":["5.44.2"],"affected":"< 5.44.2","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cwe-837","game-server","minecraft-bedrock","package","php","pocketmine-mp"],"not_affected_if":["no-public-client-access","version-5.44.2-or-later"],"how_to_check":"- Check the PocketMine-MP version in use with `composer show pocketmine/pocketmine-mp` and compare against `5.44.2`.\n- Look for `pocketmine/pocketmine-mp` in composer.lock for the installed version.","fix":"- Upgrade `pocketmine/pocketmine-mp` to `5.44.2` or later.","status":"open","published_at":"2026-10-29T16:32:58+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","triaged_at":"2026-10-29T16:35:34+00:00","updated_at":"2026-10-29T16:35:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:35:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `pocketmine/pocketmine-mp` to `5.44.2` or later.","reach":"internet","title":"PocketMine-MP: repeated login packets duplicate player objects and inflate traffic","impact":"low","summary":"A malicious Minecraft Bedrock client can send a batch of resource pack completion packets during login, causing the server to run pre-spawn setup repeatedly. This creates extra Player objects for one session, increasing memory use and outbound network traffic.","audience":"developers","category":"package","nicknames":[],"who_cares":["pocketmine-mp","minecraft-bedrock","php","game-server"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server memory and outbound bandwidth consumed by duplicated login packets, causing degradation","analyst_note":"","how_to_check":"- Check the PocketMine-MP version in use with `composer show pocketmine/pocketmine-mp` and compare against `5.44.2`.\n- Look for `pocketmine/pocketmine-mp` in composer.lock for the installed version.","plain_action":"","needs_analyst":false,"not_affected_if":["version-5.44.2-or-later","no-public-client-access"],"who_is_affected":"Operators of PocketMine-MP Minecraft Bedrock servers running a version before 5.44.2 are exposed, since any connecting client can trigger the repeated login processing. Plugins that register their own PacketHandler can mitigate it by ignoring extra ResourcePackClientResponsePacket packets, as the advisory describes. Servers running other software or not exposing PocketMine-MP to clients can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000753,"input_tokens":4470,"output_tokens":611,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-837':24B '/pmmp/pocketmine-mp/commit/7a27894146a04964ab628ed9033140fdbf887ff3':172C '5.44.2':176C '65cv':16A,21A 'amplifi':133C 'availablecommandspacket':147C 'batch':44B,97C 'bedrock':30B,39B 'caus':52B,107C 'class':157C 'client':40B,93C 'complet':48B,106C 'creat':63B,123C 'creativecontentpacket':149C 'cwe':23B 'duplic':138C 'execut':112C 'extra':64B,161C 'game':26B 'game-serv':25B 'ghsa':13A,18A 'ghsa-pg53-p7qp-65cv':12A,17A 'github.com':171C 'github.com/pmmp/pocketmine-mp/commit/7a27894146a04964ab628ed9033140fdbf887ff3':170C 'impact':117C 'increas':70B,129C 'issu':166C 'larg':140C 'log':84C 'login':51B 'malici':37B,92C 'memori':71B,130C 'memory/network':6A 'minecraft':29B,38B 'minecraft-bedrock':28B 'mp':3A,35B 'multipl':99C,118C 'network':75B,135C 'object':66B,120C 'one':68B 'outbound':74B,134C 'p7qp':15A,20A 'pack':47B,81C 'packag':31B 'packet':11A,49B,101C,144C,163C 'packethandl':156C 'patch':164C,168C 'pg53':14A,19A 'php':32B 'player':65B,119C 'plugin':151C 'pocketmin':2A,34B 'pocketmine-mp':1A,33B 'pocketmine/pocketmine-mp':22A 'potenti':5A 'pre':58B,114C,142C 'pre-spawn':57B,113C,141C 'progress':116C 'reject/ignore':159C 'releas':174C 'repeat':9A,61B,111C 'resourc':46B,80C 'resourcepackclientresponsepacket':10A,100C,104C,162C 'resourcepackstackpacket':90C 'run':56B 'send':42B,89C,95C 'server':27B,54B,88C,109C 'session':69B,128C 'setup':60B 'singl':127C 'spawn':59B,115C,143C 'stage':82C 'status':103C,105C 'summari':77C 'traffic':76B,136C 'usag':131C 'use':72B,153C 'vulner':7A 'workaround':150C","nicknames":[],"mitigations":[],"who_affected":"Operators of PocketMine-MP Minecraft Bedrock servers running a version before 5.44.2 are exposed, since any connecting client can trigger the repeated login processing. Plugins that register their own PacketHandler can mitigate it by ignoring extra ResourcePackClientResponsePacket packets, as the advisory describes. Servers running other software or not exposing PocketMine-MP to clients can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:32:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pg53-p7qp-65cv","url":"https://github.com/advisories/GHSA-pg53-p7qp-65cv","severity":"low","published_at":"2026-10-29T16:32:58+00:00","modified_at":"2026-10-29T16:33:02+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","fetched_at":"2026-10-29T16:33:51+00:00","note":null}],"documents":[{"id":17769,"url":"https://api.github.com/repos/pmmp/PocketMine-MP/security-advisories/GHSA-pg53-p7qp-65cv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17770,"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17771,"url":"https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17772,"url":"https://github.com/pmmp/PocketMine-MP/releases/tag/5.44.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}