{"id":"GHSA-pg53-p7qp-65cv","title":"PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets","summary":"PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets","severity":"low","cwe":["CWE-837"],"vendor":"pocketmine","product":"pocketmine/pocketmine-mp","ecosystem":"composer","affected":["pocketmine/pocketmine-mp < 5.44.2"],"patched":["pocketmine/pocketmine-mp 5.44.2"],"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T16:33:02Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pg53-p7qp-65cv","references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv"},{"url":"https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3"},{"url":"https://github.com/pmmp/PocketMine-MP/releases/tag/5.44.2"},{"url":"https://github.com/advisories/GHSA-pg53-p7qp-65cv"}],"tags":["ghsa","composer"],"ingestedAt":"2026-10-29T16:38:25.975Z","slug":"GHSA-pg53-p7qp-65cv","body":"## Overview\n\n### Summary\nDuring the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression.\n\n###  Impact\nMultiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.\n\n### Workarounds\nPlugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets.\n\n### Patches\nThis issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.\n\n## Affected packages\n\n- `pocketmine/pocketmine-mp < 5.44.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pocketmine/pocketmine-mp 5.44.2`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}