GHSA-pg53-p7qp-65cv
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Summary
### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. ### Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`. ### Workarounds Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets. ### Patches This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | — | 5.44.2 |
Remediation: Upgrade to 5.44.2 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.