---
id: GHSA-pg53-p7qp-65cv
title: >-
  PocketMine-MP has potential memory/network vulnerability from repeated
  ResourcePackClientResponsePacket packets
summary: >-
  PocketMine-MP has potential memory/network vulnerability from repeated
  ResourcePackClientResponsePacket packets
severity: low
cwe:
  - CWE-837
vendor: pocketmine
product: pocketmine/pocketmine-mp
ecosystem: composer
affected:
  - pocketmine/pocketmine-mp < 5.44.2
patched:
  - pocketmine/pocketmine-mp 5.44.2
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T16:33:02Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pg53-p7qp-65cv'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3
  - url: 'https://github.com/pmmp/PocketMine-MP/releases/tag/5.44.2'
  - url: 'https://github.com/advisories/GHSA-pg53-p7qp-65cv'
tags:
  - ghsa
  - composer
ingestedAt: '2026-10-29T16:38:25.975Z'
---

## Overview

### Summary
During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression.

###  Impact
Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.

### Workarounds
Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets.

### Patches
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

## Affected packages

- `pocketmine/pocketmine-mp < 5.44.2`

## Remediation

Upgrade to a patched release:

- `pocketmine/pocketmine-mp 5.44.2`