Description

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T14:17:21.263Z",
  "pubdate": "2026-09-09T14:17:21.263Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.41.1 are susceptible to a Denial of Service (DoS) vulnerability originating from improper handling of LoginPacket data structures. The flaw exists within the processing logic of clientData JSON Web Tokens (JWT) contained within incoming network packets.\nThe vulnerability allows an unauthenticated remote attacker to trigger an out-of-memory (OOM) condition by injecting maliciously crafted, deeply nested, or excessively large object structures into the clientData properties. Upon receipt, the server attempts to log these structures without applying necessary sanitization or depth-limiting filters.\nThis excessive resource consumption during the logging process forces the server to exhaust available memory, resulting in a process crash and service interruption. Because this interaction occurs during the early stages of the handshake—prior to full authentication—the attack surface is exposed to any client capable of establishing a network connection to the server.\nThe impact is significant, as it enables trivial disruption of service availability for the affected PocketMine-MP instance. Organizations and server administrators are advised to prioritize updating to version 5.41.1 or later to implement the corrective sanitization logic.",
  "technicalDetails": "The vulnerability resides in the LoginPacket processing logic of PocketMine-MP. When a client initiates a connection, it submits a LoginPacket containing a clientData field, which is encoded as a JWT. The server parses this JWT to retrieve metadata about the connecting client.\nThe root cause is an insecure logging mechanism that fails to bound the complexity of the data retrieved from the JWT payload. Specifically, when the application encounters 'unknown' or unexpected properties within the clientData object, it attempts to record these structures to the server logs. The logging subsystem performs a recursive traversal or a string serialization of these objects without depth constraints or length limits.\nAn attacker can exploit this by crafting a LoginPacket containing a deeply nested JSON object or a massive, redundant structure within the clientData payload. The attack flow proceeds as follows: 1) The attacker initiates a connection to the PocketMine-MP server using the standard Minecraft protocol. 2) The attacker sends a crafted LoginPacket where the clientData JWT is modified to include a recursive or bloated data structure. 3) The server receives the packet and passes the clientData object to the internal logger. 4) The logging function attempts to process or serialize the complex object. 5) The exponential growth in processing time and memory allocation required to handle the malicious structure leads to an out-of-memory (OOM) condition. 6) The PHP process hosting the PocketMine-MP server terminates, effectively causing a total loss of service.\nThis vulnerability is particularly dangerous because it does not require administrative privileges or valid user authentication. It is reachable via the public-facing network port used for server communication. Because the logging happens synchronously during the packet parsing phase, the server's event loop is blocked or crashed before it can reject the invalid request. The lack of sanitization ensures that any arbitrary structure provided by the client is treated as actionable data for the logging subsystem, creating a direct vector for resource exhaustion."
}