Description

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-06T12:17:13.547Z",
  "pubdate": "2026-09-06T12:17:13.547Z",
  "executiveSummary": "This vulnerability is a Denial of Service (DoS) flaw identified in the InventoryTransaction component of PocketMine-MP, affecting all versions prior to 3.15.4.\nThe vulnerability type is an algorithmic complexity attack, specifically manifesting as a resource exhaustion issue triggered by processing malicious InventoryTransactionPackets.\nThe impact involves the complete freezing of the server process, rendering it unresponsive to all legitimate client traffic. This effectively results in a total loss of service availability for the targeted Minecraft server instance.\nAttackers do not require specific elevated privileges to exploit this flaw, as the vulnerability resides within the packet handling logic exposed to incoming client connections.\nThe risk implication is critical for server operators, as the exploit is easily reproducible and can be executed remotely over the network by a malicious client without authenticated access.\nThe exploit relies on the server's inability to handle structurally complex packet data, leading to an exponential increase in CPU cycles dedicated to a single transaction evaluation.",
  "technicalDetails": "The root cause of this vulnerability lies within the findResultItem() method located in the InventoryTransaction component. The method is responsible for calculating the resulting items of an inventory transaction by traversing various pathways defined within an InventoryTransactionPacket.\nThe implementation of the findResultItem() logic fails to properly constrain the depth or complexity of the transaction pathways provided by the client. An attacker can craft a malicious InventoryTransactionPacket containing multiple, nested, or conflicting pathways. When the server attempts to parse and resolve these pathways, the recursive or iterative logic within findResultItem() encounters an exponential growth in processing complexity.\nStep-by-step exploitation flow: 1. The attacker initiates a connection to the PocketMine-MP server. 2. The attacker transmits a specifically crafted InventoryTransactionPacket. 3. The server's network layer passes this packet to the InventoryTransaction handler. 4. The handler invokes the findResultItem() method to validate or calculate the transaction. 5. Due to the malformed structure of the packet, the findResultItem() method enters an inefficient processing state where it attempts to compute an exponential number of permutations or state paths. 6. The CPU becomes fully saturated attempting to resolve these conflicting pathways, causing the server's main thread to block and effectively freeze the entire application process.\nThe vulnerability is restricted to the network-facing packet processing layer. Because this occurs during the early stages of packet handling, the exploit does not require the client to be authenticated, authenticated users or even guest entities can trigger the vulnerability by simply submitting the malicious packet.\nThis is a classic example of an Algorithmic Complexity DoS attack, where the input data forces an algorithm into its worst-case performance scenario, which is computationally infeasible to resolve within a standard execution window. The post-exploitation impact is immediate service termination until the server process is manually restarted by an administrator."
}