Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2025-71417

PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 5.32.1affected
  • 5.32.1unaffected
pkg:composer/pocketmine/pocketmine-mp

References