Description

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-09T14:17:20.837Z",
  "pubdate": "2026-09-09T14:17:20.837Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.44.2 are susceptible to a resource pack handling vulnerability that allows unauthenticated or authenticated remote attackers to trigger unintended server-side state transitions.\nThe vulnerability stems from an improper validation mechanism regarding the handling of multiple RESOURCE_PACK_CLIENT_RESPONSE_PACKET frames containing the STATUS_COMPLETED flag.\nBy intentionally transmitting a rapid sequence of these specific packets, an attacker can coerce the server into repeatedly executing the pre-spawn progression logic. This logic flaw facilitates the creation of duplicate Player objects within the server's runtime memory space.\nThe primary risk implications include resource exhaustion, specifically memory consumption amplification, and a significant increase in network overhead generated by the redundant state initialization processes.\nThis vulnerability allows an attacker to degrade server performance, potentially leading to a Denial of Service (DoS) state by consuming the available heap space or triggering out-of-memory exceptions. The exploit requires no elevated privileges and can be executed via standard network interaction during the initial resource pack negotiation phase of the Minecraft Bedrock protocol.",
  "technicalDetails": "The vulnerability resides within the PocketMine-MP packet processing pipeline responsible for the resource pack synchronization stage of the connection lifecycle. The server expects clients to acknowledge the receipt and application of resource packs via the RESOURCE_PACK_CLIENT_RESPONSE_PACKET. Specifically, the status code STATUS_COMPLETED acts as a signal to the server that the client is prepared to transition from the resource negotiation phase to the entity spawning phase.\nThe root cause of this flaw is a state machine implementation that fails to enforce strict exclusivity on the 'completed' status once the client has already signaled pack readiness. Because the packet handler does not verify whether the transition to the pre-spawn sequence has already occurred, the server logic treats subsequent valid STATUS_COMPLETED packets as new, independent triggers to initiate the player spawning routine.\nThe exploitation flow begins during the initial connection phase where the client is tasked with downloading or verifying mandatory resource packs. Upon receiving the initial RESOURCE_PACK_CLIENT_RESPONSE_PACKET with the STATUS_COMPLETED flag, the server executes the internal spawn logic, which involves the instantiation of a Player object and the allocation of associated metadata, network buffers, and session tracking objects.\nA malicious actor can exploit this by injecting multiple copies of this packet into the stream. Each processed packet forces the server to re-enter the spawning function, which erroneously allocates a new Player object without properly garbage collecting or invalidating the previous instance. This leads to object duplication and orphaned player instances residing in memory.\nThe impact of this behavior is twofold. First, heap memory usage grows linearly with every injected packet, eventually exhausting the process memory limit if the attacker sustains the attack flow. Second, since each 'spawned' player object attempts to participate in the network tick loop and may trigger its own packet synchronization routines, the server’s CPU and network I/O cycles are consumed by managing these redundant sessions. This effectively weaponizes the server’s own internal state management against itself, forcing it to maintain an invalid number of entities that are tied to a single physical connection, ultimately leading to a collapse of the server runtime environment."
}