GHSA-pg53-p7qp-65cvLow▾ SunlitPocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.
Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.
Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
pocketmine/pocketmine-mp < 5.44.2Upgrade to a patched release:
pocketmine/pocketmine-mp 5.44.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86198Medium· 4.2PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling
CVE-2026-112285Medium· 4.3Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
CVE-2025-54315High· 7.1The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
CVE-2025-62784Medium· 5.3InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins
CVE-2025-62782Medium· 5.3InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins
CVE-2025-62783Medium· 5.0InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins