pocketmine/pocketmine-mp (Packagist)
Advisories
37
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.44.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require pocketmine/pocketmine-mp:^5.44.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets |
Low EPSS 0.38% |
< 5.44.2 | 5.44.2 |
| GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets |
Low EPSS 0.38% |
< 5.44.2 | 5.44.2 |
| GHSA-xp4f-g2cm-rhg7 PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket |
Medium EPSS 0.64% |
< 5.42.1 | 5.42.1 |
| GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state |
Medium EPSS 0.35% |
< 5.39.2 | 5.39.2 |
| GHSA-7hmv-4j2j-pp6f PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` |
Medium EPSS 0.35% |
< 5.39.2 | 5.39.2 |
| GHSA-788v-5pfp-93ff PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling |
Medium EPSS 0.44% |
< 5.39.2 | 5.39.2 |
| GHSA-h6rj-3m53-887h PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket |
High EPSS 0.61% |
< 5.41.1 | 5.41.1 |
| GHSA-fqqv-56h5-f57g PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking |
Medium EPSS 0.44% |
< 5.32.1 | 5.32.1 |
| GHSA-g274-c6jj-h78p PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() |
Medium EPSS 0.55% |
< 5.25.2 | 5.25.2 |
| GHSA-h6j3-j35f-v2x7 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time) |
High EPSS 0.78% |
< 5.11.1 | 5.11.1 |
| GHSA-xc7j-wj36-qjfr PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid |
High EPSS 0.53% |
< 5.11.2 | 5.11.2 |
| GHSA-92jh-gwch-jq38 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) |
High EPSS 0.61% |
< 4.23.1 | 4.23.1 |
| GHSA-92jh-gwch-jq38 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) |
High EPSS 0.61% |
>= 5.0.0, < 5.3.1 | 5.3.1 |
| GHSA-79rc-jjh6-rc89 PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey |
High EPSS 0.38% |
>= 5.2.0, < 5.3.1 | 5.3.1 |
| GHSA-7wrv-6h42-w54f PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket |
High EPSS 0.53% |
>= 4.20.0, < 4.22.3 | 4.22.3 |
| GHSA-7wrv-6h42-w54f PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket |
High EPSS 0.53% |
>= 5.0.0, < 5.2.1 | 5.2.1 |
| GHSA-h87r-f4vc-mchv PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash |
High EPSS 0.40% |
< 4.18.1 | 4.18.1 |
| GHSA-pqp3-8rrw-g8vm PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency |
High EPSS 0.63% |
< 4.20.5 | 4.20.5 |
| GHSA-pqp3-8rrw-g8vm PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency |
High EPSS 0.63% |
>= 4.21.0, < 4.21.1 | 4.21.1 |
| GHSA-42qm-8v8m-m78c PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' |
Medium EPSS 0.53% |
< 4.18.0-ALPHA2 | 4.18.0-ALPHA2 |
| GHSA-7m9r-rq9j-wmmh PocketMine-MP vulnerable to denial-of-service by sending large modal form responses |
Medium EPSS 0.45% |
< 4.12.5 | 4.12.5 |
| GHSA-wqqv-jcfr-9f5g PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash |
High EPSS 0.53% |
< 4.8.1 | 4.8.1 |
| GHSA-8cwq-4cmf-px73 PocketMine-MP invalid skin geometry JSON data leading to server crash |
High EPSS 0.61% |
< 4.7.2 | 4.7.2 |
| GHSA-fqx3-r75h-vc89 Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP |
High EPSS 0.53% |
>= 4.0.0-BETA5, < 4.4.2 | 4.4.2 |
| GHSA-gj94-v4p9-w672 Denial-of-service vulnerability processing large chat messages containing many newlines |
Medium EPSS 0.45% |
< 4.2.10 | 4.2.10 |
| GHSA-g5rr-p69h-7v3g Insufficient type validation in pocketmine/pocketmine-mp |
High EPSS 0.53% |
< 4.2.9 | 4.2.9 |
| GHSA-46c5-pfj8-fv65 Improperly checked metadata on tools/armour itemstacks received from the client |
High EPSS 0.53% |
< 4.2.4 | 4.2.4 |
| GHSA-fm35-jgg3-3grx NaN/INF in serverbound movement packets can crash clients and servers |
High EPSS 0.53% |
< 3.18.1 | 3.18.1 |
| GHSA-h79x-98r2-g6qc Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP |
Medium EPSS 0.24% |
>= 3.0.0, < 4.0.0 | 4.0.0 |
| GHSA-wjfq-88q2-r34j Unhandled exception when decoding form response JSON |
High EPSS 0.53% |
>= 4.0.0, < 4.0.7 | 4.0.7 |
| GHSA-xh99-hw7h-wf63 Unchecked validity of Facing values in PlayerActionPacket |
High EPSS 0.70% |
< 4.0.6 | 4.0.6 |
| GHSA-c6fg-99pr-25m9 Uncapped length of skin data fields submitted by players |
High EPSS 0.63% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-c6fg-99pr-25m9 Uncapped length of skin data fields submitted by players |
High EPSS 0.63% |
< 3.26.5 | 3.26.5 |
| GHSA-p62j-hrxm-xcxf Book page text, count, and author/title length is not limited in PocketMine-MP |
High EPSS 0.44% |
< 3.26.5 | 3.26.5 |
| GHSA-p62j-hrxm-xcxf Book page text, count, and author/title length is not limited in PocketMine-MP |
High EPSS 0.44% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-j5qg-w9jg-3wg3 Inability to de-op players if listed in ops.txt with non-lowercase letters |
Medium EPSS 0.15% |
< 4.0.3 | 4.0.3 |
| GHSA-8jq6-w5cg-wm45 Exploitable inventory component chaining in PocketMine-MP |
High EPSS 0.53% |
< 3.15.4 | 3.15.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor