CVE-2026-86198: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.44.2 - Compensating control
Apply a mitigation to reduce exposure to repeated ResourcePackClientResponsePacket STATUS_COMPLETED packets from malicious clients (e.g., rate-limit or filter client traffic that triggers resource pack handling) until PocketMine-MP 5.44.2 is deployed.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious client that can connect to the affected PocketMine-MP server can exploit it. The client must be able to send multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED during resource-pack handling.
What is the operational impact of a successful attack?
Repeated packets can repeatedly trigger pre-spawn progression, creating duplicate Player objects. This amplifies memory consumption and network traffic, which can lead to denial of service.
Which versions need remediation?
PocketMine-MP versions before 5.44.2 are affected. Updating to 5.44.2 or later addresses the described packet-validation issue.