Description

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-09T14:17:21.123Z",
  "pubdate": "2026-09-09T14:17:21.123Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.42.1 are susceptible to a Denial of Service (DoS) vulnerability located within the LoginPacket handling logic. The vulnerability stems from the improper validation and processing of clientData JWT structures, allowing a remote, unauthenticated attacker to inject an arbitrary volume of junk properties into the payload.\nBy systematically flooding the server with maliciously crafted login packets, an attacker forces the application to perform excessive processing and error-handling routines. This results in significant CPU resource exhaustion, leading to degraded server performance or complete service unavailability. Because the LoginPacket is processed prior to full session authentication, the attack vector is exposed to any remote user capable of establishing a connection to the server. The primary risk implication is the degradation of service availability for legitimate users, effectively weaponizing the server's own diagnostic logging and warning mechanisms against itself to induce resource starvation.",
  "technicalDetails": "The vulnerability resides within the packet handling subsystem of PocketMine-MP, specifically during the deserialization and validation phase of the LoginPacket. Upon receiving a connection request, the server parses a JSON Web Token (JWT) contained within the clientData field of the LoginPacket. The implementation fails to enforce strict schema validation or limits on the quantity of properties contained within the JWT structure.\nAn attacker can exploit this by crafting a bespoke LoginPacket containing a massive array of unknown or extraneous key-value pairs within the clientData object. When the PocketMine-MP server attempts to parse and validate this malformed JWT, the internal logic triggers frequent warning messages for every unexpected or unrecognized property encountered. Because these warnings are generated synchronously during the packet processing pipeline, the sheer volume of output-related operations and the associated memory/CPU overhead per packet creates a massive computational bottleneck.\nThe attack flow follows a sequential pattern: first, the attacker initiates a network connection to the server. Second, the attacker transmits a series of intentionally oversized or property-dense LoginPackets. Third, the server's packet handler iterates through the injected properties. Fourth, for every invalid property identified, the server generates a log entry and warning message. Finally, the aggregate load of these operations consumes the CPU cycles allocated to the network thread or main server loop. This effectively blocks the server from processing legitimate client interactions or game logic, resulting in a state of exhaustion.\nThe vulnerable component is the LoginPacket processing routine, which lacks a hard limit on the number of properties allowed in the clientData field. Since this processing occurs at the initial handshake stage, it does not require authentication or elevated privileges, making it highly accessible over a public network. The post-exploitation impact is limited to resource exhaustion and service denial; however, it does not currently facilitate remote code execution or unauthorized data access. The lack of input sanitization regarding the JWT payload size and complexity is the root cause of this vulnerability, which is addressed in version 5.42.1 through the implementation of stricter parsing constraints and property validation."
}