Description

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T14:17:21.400Z",
  "pubdate": "2026-09-09T14:17:21.400Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.39.2 are susceptible to a network amplification vulnerability involving the handling of ActorEventPacket network messages.\nThe vulnerability allows an unauthenticated or authenticated client to inject maliciously crafted ActorEventPacket data into the server's network stream, triggering animation states across all connected, visible clients.\nBy continuously spamming these events, an attacker can induce resource exhaustion by forcing the server to process, broadcast, and render excessive animation updates for every connected player within the proximity of the target actor.\nThis impact directly affects both server-side CPU utilization and client-side memory consumption, potentially leading to significant performance degradation or localized denial-of-service (DoS) conditions.\nThe attack is remotely exploitable over the standard game network protocol. No advanced privileges are required beyond the ability to interact with the game server, making this a high-visibility concern for publicly accessible Minecraft: Bedrock Edition servers running affected versions of the PocketMine-MP engine.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of the ActorEventPacket handling logic within the PocketMine-MP networking layer. Specifically, the server fails to implement adequate rate-limiting or state-verification checks when processing animation event IDs sent from a client.\nIn the Minecraft protocol, the ActorEventPacket is utilized to synchronize state changes, such as eating animations or other character interactions, across connected sessions. When the server receives this packet, it is designed to broadcast the event to all other clients currently tracking the entity associated with the event source.\nThe exploitation flow begins when an attacker identifies the target entity's Runtime ID (Entity ID). By crafting and sending a high volume of ActorEventPacket messages, the attacker forces the server to encapsulate and relay these packets to all clients in the proximity of the target actor. Because the server does not enforce a cooldown or logical gate for these specific animation events, the attacker achieves an amplification effect; a single packet sent by the attacker results in N relayed packets, where N is the number of connected clients observing the target.\nThis leads to two primary impacts: First, the server CPU is consumed by the overhead of processing and iterating through the packet reflection list for every injected event. Second, the receiving clients are overwhelmed with constant animation updates. Since animation state updates in the Minecraft: Bedrock Edition client engine can be resource-intensive, sustained spamming forces a significant memory and rendering load on the client devices, effectively degrading performance or causing the client application to freeze/crash.\nThe vulnerability resides within the packet handling implementation of the PocketMine-MP core, which acts as the intermediary between the network socket and the entity management system. Exploitation does not require elevated privileges or administrative access, as the protocol expects these packets as part of standard gameplay interactions. The attack is performed entirely over the established network connection. There are no secondary authorization checks performed on the packet payload's legitimacy before the server broadcasts the event to peer entities, allowing for the arbitrary triggering of consuming animations as long as the target entity is valid and visible to the server state."
}