CVE-2025-71417: PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client can exploit it by sending a ResourcePackClientResponsePacket containing multiple copies of valid pack UUIDs. No user interaction is required.
What is the impact on an affected server?
Duplicate pack transmissions can exhaust server memory and cause a denial of service. The provided impact information indicates availability is affected, with no stated confidentiality or integrity impact.
Which deployments are affected?
PocketMine-MP versions before 5.32.1 are affected. The issue occurs during STATUS_SEND_PACKS handling when pack UUID uniqueness is not validated.
How can I tell whether a server is exposed?
A server is exposed if it runs a PocketMine-MP version earlier than 5.32.1 and handles resource-pack responses in the affected code path. Exploitation requires valid pack UUIDs and an authenticated client connection.