PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Low · fetched 2026-10-29
### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. ### Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.
Remediation
Upgrade pocketmine/pocketmine-mp to 5.44.2 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-29T14:20:28-04:00 · https://github.com/advisories/GHSA-pg53-p7qp-65cv