Security advisories

medium2026-04-15

PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket

GHSA-xp4f-g2cm-rhg7

low2026-04-06

PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state

GHSA-f9jp-856v-8642

medium2026-04-06

PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

GHSA-7hmv-4j2j-pp6f

high2026-04-06

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

GHSA-788v-5pfp-93ff

high2026-04-06

PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

GHSA-h6rj-3m53-887h

high2025-09-02

PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking

GHSA-fqqv-56h5-f57g

medium2025-03-10

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

GHSA-g274-c6jj-h78p

high2024-03-06

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

GHSA-h6j3-j35f-v2x7

high2024-03-06

PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

GHSA-xc7j-wj36-qjfr

high2023-09-14

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

GHSA-92jh-gwch-jq38

high2023-09-14

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

GHSA-79rc-jjh6-rc89

high2023-07-14

PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket

GHSA-7wrv-6h42-w54f

high2023-06-06

PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash

GHSA-h87r-f4vc-mchv · CVE-2023-7332

high2023-06-06

PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

GHSA-pqp3-8rrw-g8vm

medium2023-06-01

PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'

GHSA-42qm-8v8m-m78c

medium2023-01-10

PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

GHSA-7m9r-rq9j-wmmh

high2023-01-09

PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash

GHSA-wqqv-jcfr-9f5g

high2022-08-18

PocketMine-MP invalid skin geometry JSON data leading to server crash

GHSA-8cwq-4cmf-px73

high2022-06-07

Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP

GHSA-fqx3-r75h-vc89

medium2022-05-25

Denial-of-service vulnerability processing large chat messages containing many newlines

GHSA-gj94-v4p9-w672