Description

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:10.740Z",
  "pubdate": "2026-09-09T14:17:10.740Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.32.1 are vulnerable to a Denial of Service (DoS) attack originating from improper validation of ResourcePackClientResponsePacket data.\nThe vulnerability manifests as a resource exhaustion condition where an authenticated client can induce the server to initiate multiple redundant transmissions of the same resource pack.\nBy manipulating the STATUS_SEND_PACKS phase of the handshake, an attacker can force the server to allocate excessive memory buffers, ultimately leading to process instability or complete service termination.\nThis vulnerability is classified as an improper input validation flaw that results in resource exhaustion.\nExploitation requires the attacker to have an established, authenticated connection to the server. The impact is limited to availability, as successful exploitation results in server-wide memory starvation.\nThere are no specific privilege requirements beyond the ability to initiate a resource pack exchange process during the client connection sequence.",
  "technicalDetails": "The vulnerability resides within the packet handling logic for ResourcePackClientResponsePacket, specifically during the processing of the STATUS_SEND_PACKS status code. PocketMine-MP fails to implement a uniqueness constraint or an idempotency check on the pack UUIDs provided within the client's response packet.\nIn the standard PocketMine-MP protocol flow, the server sends a list of resource packs to the client. The client responds with a ResourcePackClientResponsePacket containing the UUIDs of packs it intends to download. The server logic, prior to version 5.32.1, processes this response by iterating through the provided UUIDs and initiating the transmission phase for each entry without verifying if a request for a specific UUID has already been queued or processed within the current session context.\nAn authenticated attacker can craft a malicious ResourcePackClientResponsePacket containing a highly repetitive list of valid, server-recognized pack UUIDs. Upon receiving this packet, the server's network handler iterates over every entry provided, regardless of redundancy. For each UUID entry, the server allocates internal memory buffers to stage the resource pack transmission, adds the transmission task to the I/O queue, and prepares the corresponding file read operations.\nBy saturating the packet with multiple identical UUIDs, the attacker forces the server to create a massive volume of concurrent, redundant transmission tasks. This behavior leads to rapid, uncontrolled memory consumption as the server attempts to hold multiple instances of the same resource pack data in the output buffer for a single client connection. When the cumulative memory allocation exceeds the operational capacity of the server's heap or the configured memory limits, the server experiences an Out of Memory (OOM) error or triggers a crash due to garbage collection pressure and resource exhaustion.\nThe attack flow proceeds as follows: 1) The attacker establishes a standard connection to the PocketMine-MP server. 2) The server mandates a resource pack handshake. 3) The attacker responds with a crafted ResourcePackClientResponsePacket containing a payload of duplicated UUIDs. 4) The server processes the malicious list, allocating memory for every duplicate entry. 5) The server's available memory is exhausted, resulting in a denial of service for all users."
}