GHSA-pg53-p7qp-65cv: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Summary During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUSCOMPLETED causing the server to repeatedly execute pre-spawn progression.
Impact Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.
Workarounds Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.
Patches This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
Other sources
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pocketmine/pocketmine-mpto a version that resolves this vulnerability.Fixed in 5.44.2 - Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.44.2Patch 7a27894146a04964ab628ed9033140fdbf887ff3
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious client that reaches the resource-pack stage of login can exploit it. The client must be able to send repeated ResourcePackClientResponsePacket packets with the completed status after the server sends ResourcePackStackPacket.
What is the operational impact of exploitation?
A single session can cause multiple Player objects to be created, increasing server memory use. It also amplifies outbound traffic by duplicating large pre-spawn packets, including AvailableCommandsPacket and CreativeContentPacket.
Are default deployments affected?
The issue occurs in the normal resource-pack login progression when repeated completed responses are accepted. The provided data does not identify a configuration prerequisite beyond reaching that stage.
What can be done before upgrading?
Plugins can implement PacketHandler classes to reject or ignore additional ResourcePackClientResponsePacket packets. This prevents extra completed responses from repeatedly triggering pre-spawn progression.
What version fixes the issue?
The fix was released in PocketMine-MP version 5.44.2. The patch is identified by commit 7a27894146a04964ab628ed9033140fdbf887ff3.