Repeated resource pack responses duplicate player setup in PocketMine-MP
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
PocketMine-MP before 5.44.2 (Packagist package pocketmine/pocketmine-mp) does not limit repeated resource pack responses during login. A malicious client can send a batch of ResourcePackClientResponsePacket packets with the completed status, causing the server to run pre-spawn progression repeatedly. Each repetition creates an extra Player object for the same session and resends large pre-spawn packets, increasing memory use and outbound network traffic. The weakness is classified as CWE-837.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the GitHub advisory
### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. ### Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`. ### Workarounds Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets. ### Patches This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pocketmine/pocketmine-mp (Packagist) | before 5.44.2 | 5.44.2 | Patch available | GHSA-pg53-p7qp-65cv |
- pocketmine/pocketmine-mp (Packagist) Vendor— Affected before 5.44.2 Fixed in 5.44.2 Patch available GHSA-pg53-p7qp-65cv
Remediation
Update pocketmine/pocketmine-mp to 5.44.2, which fixes the issue. Plugins can alternatively use their own PacketHandler classes that reject or ignore extra ResourcePackClientResponsePacket packets.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-pg53-p7qp-65cv pocketmine/pocketmine-mp (Packagist) Fixed in 5.44.2 Advisory →
Timeline
- 2026-10-29 Threatist record created from GHSA-pg53-p7qp-65cv
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences