What’s Vulnerable › Products

pmmp PocketMine-MP vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 33 published in the last 12 months.

Check whether your pmmp PocketMine-MP version is affected

Latest pmmp PocketMine-MP vulnerabilities

• CVE-2026-86204 — PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket (CVSS 6.5)
• CVE-2026-86203 — PocketMine-MP before 5.39.2 Item Duplication via Despawn State (CVSS 3.7)
• CVE-2026-86202 — PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket (CVSS 4.3)
• CVE-2026-86201 — PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData (CVSS 7.5)
• CVE-2026-86200 — PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT (CVSS 5.3)
• CVE-2026-86199 — PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login (CVSS 7.5)
• CVE-2026-86198 — PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (CVSS 4.2)
• CVE-2025-71418 — PocketMine-MP before 5.25.2 Denial of Service via explode (CVSS 5.3)
• CVE-2025-71417 — PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket (CVSS 6.5)
• CVE-2024-58381 — PocketMine-MP before 5.11.1 Denial of Service via LoginPacket (CVSS 7.5)
• CVE-2024-58380 — PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket (CVSS 6.5)
• CVE-2023-54396 — PocketMine-MP before 4.8.1 Server Crash via Banner NBT (CVSS 6.5)
• CVE-2023-54395 — PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket (CVSS 4.3)
• CVE-2023-54394 — PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket (CVSS 4.3)
• CVE-2023-54393 — PocketMine-MP before 4.20.5 Denial of Service via LoginPacket (CVSS 7.5)
• CVE-2023-54392 — PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket (CVSS 6.5)
• CVE-2023-54390 — PocketMine-MP before 5.3.1 Denial of Service via LoginPacket (CVSS 7.5)
• CVE-2023-54355 — PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve (CVSS 7.5)
• CVE-2022-51018 — PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages (CVSS 6.5)
• CVE-2022-51017 — PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data (CVSS 7.5)
• CVE-2022-51016 — PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay (CVSS 6.1)
• CVE-2022-51015 — PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket (CVSS 6.5)
• CVE-2022-51014 — PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding (CVSS 6.5)
• CVE-2022-51013 — PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata (CVSS 6.5)
• CVE-2022-51012 — PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization (CVSS 6.5)