GHSA-pg53-p7qp-65cv CVE-2026-86198

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Low Packagist

Severity: 2.3 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.38%; Chance of exploitation in the next 30 days. Higher than 32.22% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-837 Improper Enforcement of a Single, Unique Action
Fix: 5.44.2; Upgrade pocketmine/pocketmine-mp to this version or later

Description

Summary

During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.

Impact

Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.

Workarounds

Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.

Patches

This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

Affected versions

Packagist

Package	Vulnerable	Fixed in
pocketmine/pocketmine-mp	`< 5.44.2`	`5.44.2`
pocketmine/pocketmine-mp	`< 5.44.2`	`5.44.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pocketmine/pocketmine-mp Packagist → `5.44.2`

composer

composer require pocketmine/pocketmine-mp:^5.44.2

Severity breakdown

CVSS 4.0 2.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-837: Improper Enforcement of a Single, Unique Action

The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

References

Advisories

Fixes and patches

github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3

Packages

github.com/pmmp/PocketMine-MP

Timeline

Oct 29, 2026 Published
Oct 29, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-xp4f-g2cm-rhg7 PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket	Medium	Also affects pocketmine/pocketmine-mp
GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state	Medium	Also affects pocketmine/pocketmine-mp
GHSA-7hmv-4j2j-pp6f PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`	Medium	Also affects pocketmine/pocketmine-mp
GHSA-788v-5pfp-93ff PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling	Medium	Also affects pocketmine/pocketmine-mp
GHSA-h6rj-3m53-887h PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket	High	Also affects pocketmine/pocketmine-mp
GHSA-fqqv-56h5-f57g PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking	Medium	Also affects pocketmine/pocketmine-mp
GHSA-g274-c6jj-h78p PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()	Medium	Also affects pocketmine/pocketmine-mp
GHSA-h6j3-j35f-v2x7 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)	High	Also affects pocketmine/pocketmine-mp

Credits: Genesizs, dktapps

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor