CVE-2020-37277: PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-06 · updated 2026-10-08
Weakness: CWE-400

Description

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.

Affected products

pmmp PocketMine-MP: before 3.15.4 — fixed in 3.15.4

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 3.15.4. Check the vendor advisory for mitigations.

References

https://github.com/pmmp/PocketMine-MP/commit/c368ebb5e74632bc622534b37cd1447b97281e20
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45
https://www.vulncheck.com/advisories/pocketmine-mp-before-3.15.4-denial-of-service-via-inventorytransaction

Get alerted when CVE-2020-37277 or the next vulnerability affects your stack