GHSA-pg53-p7qp-65cv: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

October 29, 2026

During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.

References

github.com/advisories/GHSA-pg53-p7qp-65cv
github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3
github.com/pmmp/PocketMine-MP/releases/tag/5.44.2
github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv

Code Behaviors & Features

Detect and mitigate GHSA-pg53-p7qp-65cv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →