Search
Find a vulnerability
Search criteria
66 vulnerabilities by pmmp
CVE-2026-86204 (GCVE-0-2026-86204)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:19
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
Summary
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:18 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86204",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:18:46.084735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:19:07.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zwuiix-cmd"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:05.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-788v-5pfp-93ff)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket"
}
],
"title": "PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86204",
"datePublished": "2026-09-09T13:32:05.073Z",
"dateReserved": "2026-09-05T11:52:36.822Z",
"dateUpdated": "2026-09-09T14:19:07.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86203 (GCVE-0-2026-86203)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Item Duplication via Despawn State
Summary
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.
Severity
CWE
- CWE-664 - Improper Control of a Resource Through its Lifetime
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c071… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kostamax27"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "Improper Control of a Resource Through its Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:04.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f9jp-856v-8642)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Item Duplication via Despawn State",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-item-duplication-via-despawn-state"
}
],
"title": "PocketMine-MP before 5.39.2 Item Duplication via Despawn State",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86203",
"datePublished": "2026-09-09T13:32:04.400Z",
"dateReserved": "2026-09-05T11:52:36.822Z",
"dateUpdated": "2026-09-09T13:32:04.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86202 (GCVE-0-2026-86202)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:45
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Summary
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:35 UTC
CWE
- CWE-406 - Insufficient Control of Network Message Volume (Network Amplification)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/aeea… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:35:48.114658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:45:30.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-406",
"description": "Insufficient Control of Network Message Volume (Network Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:03.254Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7hmv-4j2j-pp6f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket"
}
],
"title": "PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86202",
"datePublished": "2026-09-09T13:32:03.254Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T14:45:30.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86201 (GCVE-0-2026-86201)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
Summary
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/87d1… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.41.1
(semver)
Unaffected: 5.41.1 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.41.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.41.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ArkadiaEU"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:02.506Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6rj-3m53-887h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.41.1-logdos-via-loginpacket-clientdata"
}
],
"title": "PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86201",
"datePublished": "2026-09-09T13:32:02.506Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:02.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86200 (GCVE-0-2026-86200)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
Summary
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Severity
5.3 (Medium)
CWE
- CWE-779 - Logging of Excessive Data
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c1d4… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.42.1
(semver)
Unaffected: 5.42.1 (semver) |
Date Public
2026-04-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.42.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.42.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iYozemMc"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-779",
"description": "Logging of Excessive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:01.818Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xp4f-g2cm-rhg7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt"
}
],
"title": "PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86200",
"datePublished": "2026-09-09T13:32:01.818Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:01.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86199 (GCVE-0-2026-86199)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:17
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
Summary
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:16 UTC
CWE
- CWE-184 - Incomplete List of Disallowed Inputs
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/e4aa… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/8c75… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.43.1
(semver)
Unaffected: 5.43.1 (semver) |
Date Public
2026-05-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86199",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:16:06.102661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:17:19.917Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.43.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.43.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kostamax27"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-05-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "Incomplete List of Disallowed Inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:01.117Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g2fj-p69p-9chp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/e4aaef4ee0f769b52dc0347a1d6da403b9691115"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/8c75a1d739e8e190d3cc2338b25cebcc9c052b1b"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.43.1-denial-of-service-via-unauthenticated-login"
}
],
"title": "PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86199",
"datePublished": "2026-09-09T13:32:01.117Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T14:17:19.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86198 (GCVE-0-2026-86198)
Vulnerability from nvd – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
Summary
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
Severity
CWE
- CWE-837 - Improper Enforcement of a Single, Unique Action
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/7a27… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.44.2
(semver)
Unaffected: 5.44.2 (semver) |
Date Public
2026-06-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.44.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.44.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Genesizs"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-837",
"description": "Improper Enforcement of a Single, Unique Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:00.417Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pg53-p7qp-65cv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.44.2-denial-of-service-via-resourcepackclientresponsepacket"
}
],
"title": "PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86198",
"datePublished": "2026-09-09T13:32:00.417Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:00.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71418 (GCVE-0-2025-71418)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 14:15
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.25.2 Denial of Service via explode
Summary
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:14 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/d0d8… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.25.2
(semver)
Unaffected: 5.25.2 (semver) |
Date Public
2025-03-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:14:00.996696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:15:47.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.25.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.25.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-03-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:57.642Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g274-c6jj-h78p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.25.2 Denial of Service via explode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.25.2-denial-of-service-via-explode"
}
],
"title": "PocketMine-MP before 5.25.2 Denial of Service via explode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71418",
"datePublished": "2026-09-09T13:31:57.642Z",
"dateReserved": "2026-09-05T20:57:29.404Z",
"dateUpdated": "2026-09-09T14:15:47.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71417 (GCVE-0-2025-71417)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
Summary
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.32.1
(semver)
Unaffected: 5.32.1 (semver) |
Date Public
2025-08-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.32.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.32.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zwuiix-cmd"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2025-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:56.926Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fqqv-56h5-f57g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqqv-56h5-f57g"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.32.1-denial-of-service-via-resourcepackclientresponsepacket"
}
],
"title": "PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71417",
"datePublished": "2026-09-09T13:31:56.926Z",
"dateReserved": "2026-09-05T20:56:49.037Z",
"dateUpdated": "2026-09-09T13:31:56.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58381 (GCVE-0-2024-58381)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
Summary
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/b96a… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/6872… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.11.1
(semver)
Unaffected: 5.11.1 (semver) |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
},
{
"lang": "en",
"type": "reporter",
"value": "MrDiamond64"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:55.512Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6j3-j35f-v2x7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.11.1 Denial of Service via LoginPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-loginpacket"
}
],
"title": "PocketMine-MP before 5.11.1 Denial of Service via LoginPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58381",
"datePublished": "2026-09-09T13:31:55.512Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-09-09T13:31:55.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58380 (GCVE-0-2024-58380)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
Summary
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/47f0… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.11.2
(semver)
Unaffected: 5.11.2 (semver) |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GameParrot"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:54.824Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xc7j-wj36-qjfr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.2-denial-of-service-via-bookeditpacket"
}
],
"title": "PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58380",
"datePublished": "2026-09-09T13:31:54.824Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-09-09T13:31:54.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54396 (GCVE-0-2023-54396)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 14:10 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.8.1 Server Crash via Banner NBT
Summary
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:10 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/08b9… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.8.1
(semver)
Unaffected: 4.8.1 (semver) |
Date Public
2023-01-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:10:39.674626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:10:48.619Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.8.1",
"versionType": "semver"
}
]
}
],
"datePublic": "2023-01-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:54.170Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wqqv-jcfr-9f5g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.8.1 Server Crash via Banner NBT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.8.1 Server Crash via Banner NBT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54396",
"datePublished": "2026-09-09T13:31:54.170Z",
"dateReserved": "2026-09-05T21:00:50.888Z",
"dateUpdated": "2026-09-09T14:10:48.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54395 (GCVE-0-2023-54395)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
Summary
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.
Severity
4.3 (Medium)
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/3baa… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.12.5
(semver)
Unaffected: 4.12.5 (semver) |
Date Public
2023-01-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.12.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "AkmalFairuz"
}
],
"datePublic": "2023-01-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:53.472Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7m9r-rq9j-wmmh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7m9r-rq9j-wmmh"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/3baa5ab71214f96e6e7ab12cb9beef08118473b5"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.5-denial-of-service-via-modalformresponsepacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54395",
"datePublished": "2026-09-09T13:31:53.472Z",
"dateReserved": "2026-09-05T21:00:04.786Z",
"dateUpdated": "2026-09-09T13:31:53.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54394 (GCVE-0-2023-54394)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 15:27 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
Summary
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:19 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/ca6d… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.18.0-ALPHA2
(semver)
Unaffected: 4.18.0-ALPHA2 (semver) |
Date Public
2023-05-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:19:38.383031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:27:28.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.18.0-ALPHA2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.18.0-ALPHA2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2023-05-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:52.799Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-42qm-8v8m-m78c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/ca6d51498f12427a947467da8fcad7811418e6cc"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.18.0-alpha2-bandwidth-amplification-via-inventorytransactionpacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54394",
"datePublished": "2026-09-09T13:31:52.799Z",
"dateReserved": "2026-09-05T21:00:00.748Z",
"dateUpdated": "2026-09-09T15:27:28.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54393 (GCVE-0-2023-54393)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
Summary
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/a319… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/0966… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2023-05-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "aderoian"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2023-05-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:52.111Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pqp3-8rrw-g8vm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pqp3-8rrw-g8vm"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.20.5 Denial of Service via LoginPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.20.5-denial-of-service-via-loginpacket"
}
],
"title": "PocketMine-MP before 4.20.5 Denial of Service via LoginPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54393",
"datePublished": "2026-09-09T13:31:52.111Z",
"dateReserved": "2026-09-05T20:59:39.275Z",
"dateUpdated": "2026-09-09T13:31:52.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54392 (GCVE-0-2023-54392)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket
Summary
PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/0c25… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2023-07-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ShockedPlot7560"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2023-07-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions \u003e= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:51.436Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7wrv-6h42-w54f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.22.3-denial-of-service-via-blockactordatapacket"
}
],
"title": "PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54392",
"datePublished": "2026-09-09T13:31:51.436Z",
"dateReserved": "2026-09-05T20:59:17.555Z",
"dateUpdated": "2026-09-09T13:31:51.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54390 (GCVE-0-2023-54390)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 14:09
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
Summary
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:09 UTC
CWE
- CWE-1025 - Comparison Using Wrong Factors
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/4f90… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2023-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:09:45.573013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:09:54.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alvin0319"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2023-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1025",
"description": "Comparison Using Wrong Factors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:50.742Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-92jh-gwch-jq38)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.3.1 Denial of Service via LoginPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket"
}
],
"title": "PocketMine-MP before 5.3.1 Denial of Service via LoginPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54390",
"datePublished": "2026-09-09T13:31:50.742Z",
"dateReserved": "2026-09-01T11:04:28.968Z",
"dateUpdated": "2026-09-09T14:09:54.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54355 (GCVE-0-2023-54355)
Vulnerability from nvd – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
Summary
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.
Severity
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/4e64… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2023-09-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2023-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:50.013Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-79rc-jjh6-rc89)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-79rc-jjh6-rc89"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/4e646d19a4a1e0d082bd4d1f5a58ae0182a268d9"
},
{
"name": "VulnCheck Advisory: PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-5.2.0-server-crash-via-incorrect-ec-curve"
}
],
"title": "PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54355",
"datePublished": "2026-09-09T13:31:50.013Z",
"dateReserved": "2026-01-10T01:51:52.987Z",
"dateUpdated": "2026-09-09T13:31:50.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86204 (GCVE-0-2026-86204)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:19
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
Summary
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:18 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86204",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:18:46.084735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:19:07.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zwuiix-cmd"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:05.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-788v-5pfp-93ff)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket"
}
],
"title": "PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86204",
"datePublished": "2026-09-09T13:32:05.073Z",
"dateReserved": "2026-09-05T11:52:36.822Z",
"dateUpdated": "2026-09-09T14:19:07.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86203 (GCVE-0-2026-86203)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Item Duplication via Despawn State
Summary
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.
Severity
CWE
- CWE-664 - Improper Control of a Resource Through its Lifetime
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c071… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kostamax27"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "Improper Control of a Resource Through its Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:04.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f9jp-856v-8642)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Item Duplication via Despawn State",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-item-duplication-via-despawn-state"
}
],
"title": "PocketMine-MP before 5.39.2 Item Duplication via Despawn State",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86203",
"datePublished": "2026-09-09T13:32:04.400Z",
"dateReserved": "2026-09-05T11:52:36.822Z",
"dateUpdated": "2026-09-09T13:32:04.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86202 (GCVE-0-2026-86202)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:45
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Summary
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:35 UTC
CWE
- CWE-406 - Insufficient Control of Network Message Volume (Network Amplification)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/aeea… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.39.2
(semver)
Unaffected: 5.39.2 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:35:48.114658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:45:30.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.39.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.39.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-406",
"description": "Insufficient Control of Network Message Volume (Network Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:03.254Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7hmv-4j2j-pp6f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket"
}
],
"title": "PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86202",
"datePublished": "2026-09-09T13:32:03.254Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T14:45:30.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86201 (GCVE-0-2026-86201)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
Summary
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/87d1… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.41.1
(semver)
Unaffected: 5.41.1 (semver) |
Date Public
2026-04-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.41.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.41.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ArkadiaEU"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:02.506Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6rj-3m53-887h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.41.1-logdos-via-loginpacket-clientdata"
}
],
"title": "PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86201",
"datePublished": "2026-09-09T13:32:02.506Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:02.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86200 (GCVE-0-2026-86200)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
Summary
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Severity
5.3 (Medium)
CWE
- CWE-779 - Logging of Excessive Data
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c1d4… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.42.1
(semver)
Unaffected: 5.42.1 (semver) |
Date Public
2026-04-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.42.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.42.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iYozemMc"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-04-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-779",
"description": "Logging of Excessive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:01.818Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xp4f-g2cm-rhg7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt"
}
],
"title": "PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86200",
"datePublished": "2026-09-09T13:32:01.818Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:01.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86199 (GCVE-0-2026-86199)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:17
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
Summary
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:16 UTC
CWE
- CWE-184 - Incomplete List of Disallowed Inputs
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/e4aa… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/8c75… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.43.1
(semver)
Unaffected: 5.43.1 (semver) |
Date Public
2026-05-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86199",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:16:06.102661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:17:19.917Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.43.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.43.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kostamax27"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-05-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "Incomplete List of Disallowed Inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:01.117Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g2fj-p69p-9chp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/e4aaef4ee0f769b52dc0347a1d6da403b9691115"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/8c75a1d739e8e190d3cc2338b25cebcc9c052b1b"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.43.1-denial-of-service-via-unauthenticated-login"
}
],
"title": "PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86199",
"datePublished": "2026-09-09T13:32:01.117Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T14:17:19.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86198 (GCVE-0-2026-86198)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
Summary
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
Severity
CWE
- CWE-837 - Improper Enforcement of a Single, Unique Action
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/7a27… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.44.2
(semver)
Unaffected: 5.44.2 (semver) |
Date Public
2026-06-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.44.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.44.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Genesizs"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-837",
"description": "Improper Enforcement of a Single, Unique Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:00.417Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pg53-p7qp-65cv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.44.2-denial-of-service-via-resourcepackclientresponsepacket"
}
],
"title": "PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86198",
"datePublished": "2026-09-09T13:32:00.417Z",
"dateReserved": "2026-09-05T11:52:36.821Z",
"dateUpdated": "2026-09-09T13:32:00.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71418 (GCVE-0-2025-71418)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:31 – Updated: 2026-09-09 14:15
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.25.2 Denial of Service via explode
Summary
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:14 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/d0d8… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.25.2
(semver)
Unaffected: 5.25.2 (semver) |
Date Public
2025-03-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:14:00.996696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:15:47.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.25.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.25.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-03-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:57.642Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g274-c6jj-h78p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.25.2 Denial of Service via explode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.25.2-denial-of-service-via-explode"
}
],
"title": "PocketMine-MP before 5.25.2 Denial of Service via explode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71418",
"datePublished": "2026-09-09T13:31:57.642Z",
"dateReserved": "2026-09-05T20:57:29.404Z",
"dateUpdated": "2026-09-09T14:15:47.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71417 (GCVE-0-2025-71417)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
Summary
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.32.1
(semver)
Unaffected: 5.32.1 (semver) |
Date Public
2025-08-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.32.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.32.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zwuiix-cmd"
},
{
"lang": "en",
"type": "finder",
"value": "dktapps"
}
],
"datePublic": "2025-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:56.926Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fqqv-56h5-f57g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqqv-56h5-f57g"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.32.1-denial-of-service-via-resourcepackclientresponsepacket"
}
],
"title": "PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71417",
"datePublished": "2026-09-09T13:31:56.926Z",
"dateReserved": "2026-09-05T20:56:49.037Z",
"dateUpdated": "2026-09-09T13:31:56.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58381 (GCVE-0-2024-58381)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
Summary
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/b96a… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/6872… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.11.1
(semver)
Unaffected: 5.11.1 (semver) |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dktapps"
},
{
"lang": "en",
"type": "reporter",
"value": "MrDiamond64"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:55.512Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6j3-j35f-v2x7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.11.1 Denial of Service via LoginPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-loginpacket"
}
],
"title": "PocketMine-MP before 5.11.1 Denial of Service via LoginPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58381",
"datePublished": "2026-09-09T13:31:55.512Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-09-09T13:31:55.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58380 (GCVE-0-2024-58380)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:31 – Updated: 2026-09-09 13:31
VLAI
EPSS
VEX
Title
PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
Summary
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/47f0… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 5.11.2
(semver)
Unaffected: 5.11.2 (semver) |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GameParrot"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:54.824Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xc7j-wj36-qjfr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.2-denial-of-service-via-bookeditpacket"
}
],
"title": "PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58380",
"datePublished": "2026-09-09T13:31:54.824Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-09-09T13:31:54.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54396 (GCVE-0-2023-54396)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:31 – Updated: 2026-09-09 14:10 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.8.1 Server Crash via Banner NBT
Summary
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:10 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/08b9… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.8.1
(semver)
Unaffected: 4.8.1 (semver) |
Date Public
2023-01-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:10:39.674626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:10:48.619Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.8.1",
"versionType": "semver"
}
]
}
],
"datePublic": "2023-01-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:31:54.170Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wqqv-jcfr-9f5g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.8.1 Server Crash via Banner NBT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.8.1 Server Crash via Banner NBT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54396",
"datePublished": "2026-09-09T13:31:54.170Z",
"dateReserved": "2026-09-05T21:00:50.888Z",
"dateUpdated": "2026-09-09T14:10:48.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}