Description

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-09T14:17:21.550Z",
  "pubdate": "2026-09-09T14:17:21.550Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.39.2 are susceptible to an item and experience duplication vulnerability stemming from improper validation of entity states during packet processing.\nThe vulnerability is classified as a race condition vulnerability within the entity management logic, specifically occurring when a client sends attack packets targeting an entity that is currently undergoing a disconnection or despawn process.\nAn unauthenticated or authenticated remote attacker can exploit this flaw to trigger multiple death handler executions for a single player instance.\nSuccessful exploitation results in the duplication of inventory items and experience points, which compromises the integrity of the server's economy and progression systems.\nThe risk is considered significant for multiplayer environments where item rarity and player progression are core mechanics.\nExploitation requires precise timing to interact with the server's state-transition lifecycle, effectively tricking the engine into processing the same death event multiple times due to insufficient synchronization between the network packet handler and the entity state management system.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of state validation within the PocketMine-MP network stack when processing incoming entity attack packets.\nWhen a player initiates a disconnection sequence, the entity lifecycle transitions into a 'despawning' state. However, the server-side packet processing logic does not verify if the entity is already in a state of terminal cleanup or despawn before applying damage calculations or triggering death-related handlers.\nThe exploitation flow initiates when an attacker monitors the network activity of a target player or manages two accounts to synchronize a disconnection event. As the target begins the disconnection process, the attacker sends specially crafted attack packets to the target entity.\nBecause the server fails to implement an atomic check-and-set or lock on the entity state, the race condition allows the death handler to be invoked repeatedly before the object is fully removed from the server's entity manager.\nSpecifically, the death handler is designed to drop the player's inventory contents and accumulated experience points onto the game world map. By triggering this handler multiple times through the race condition, the server repeatedly spawns instances of the dropped loot while failing to decrement the original inventory state correctly due to the entity's pending removal.\nThis vulnerability persists because the entity state is not effectively gated during the transition from active to despawned. The server-side logic processes the attack request as valid based on the entity's existence in memory, while the subsequent death logic triggers the drops without accounting for previous death events occurring in the same tick cycle.\nThe affected components are the entity management and network packet processing modules in PocketMine-MP versions before 5.39.2. This vulnerability is actionable over the network and does not require elevated administrative privileges, as any player with the ability to interact with entities can attempt to trigger the race condition.\nThe post-exploitation impact includes the systematic inflation of rare items and experience points, leading to a catastrophic breakdown of server economic balance. The vulnerability is strictly an application-layer logical flaw and does not involve memory corruption or remote code execution."
}