---
id: "GHSA-pg53-p7qp-65cv"
kind: "vulnerability"
aliases: ["GHSA-pg53-p7qp-65cv"]
title: "PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pocketmine/pocketmine-mp", "fixed": ["5.44.2"], "affected": "< 5.44.2", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cwe-837", "game-server", "minecraft-bedrock", "package", "php", "pocketmine-mp"]
not_affected_if: ["no-public-client-access", "version-5.44.2-or-later"]
published_at: "2026-10-29T16:32:58+00:00"
first_seen_at: "2026-10-29T16:33:51+00:00"
updated_at: "2026-10-29T16:35:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pg53-p7qp-65cv", "first_seen_at": "2026-10-29T16:33:51+00:00"}]
---

# PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

A malicious Minecraft Bedrock client can send a batch of resource pack completion packets during login, causing the server to run pre-spawn setup repeatedly. This creates extra Player objects for one session, increasing memory use and outbound network traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:pocketmine/pocketmine-mp affected < 5.44.2 fixed 5.44.2

## How to check

- Check the PocketMine-MP version in use with `composer show pocketmine/pocketmine-mp` and compare against `5.44.2`.
- Look for `pocketmine/pocketmine-mp` in composer.lock for the installed version.

## Fix

- Upgrade `pocketmine/pocketmine-mp` to `5.44.2` or later.

## Timeline

- 2026-10-29T16:33:51+00:00 ghsa https://github.com/advisories/GHSA-pg53-p7qp-65cv

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/pmmp/PocketMine-MP/security-advisories/GHSA-pg53-p7qp-65cv
- [advisory] Maintainer's advisory: github.com https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv
- [fix] Patch: github.com https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3
- [fix] Release: github.com https://github.com/pmmp/PocketMine-MP/releases/tag/5.44.2

## From the sources

### Summary
During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression.

###  Impact
Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.

### Workarounds
Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets.

### Patches
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_