CVE-2020-37277: PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
Published Sep 6, 2026
·Updated
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.
Affected Software
1 affected component
PocketMine-MP<3.15.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 3.15.4Patch Denial of Service via InventoryTransaction
Event History
Sep 6, 2026
CVE Published
via MITRE·12:00 PM
Data Sourced
via MITRE·12:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to trigger the denial of service?
The attacker needs low-level privileges and network access. No user interaction is required.
2
What is the impact of successful exploitation?
Specially crafted InventoryTransactionPackets can cause exponential processing in findResultItem(), freezing the PocketMine-MP server and affecting availability.