What’s Vulnerable › Vulnerabilities

CVE-2025-71417: PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-19
• Weakness: CWE-20

Description

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.

Affected products

• pmmp PocketMine-MP: before 5.32.1 — fixed in 5.32.1

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 5.32.1. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqqv-56h5-f57g
• https://www.vulncheck.com/advisories/pocketmine-mp-before-5.32.1-denial-of-service-via-resourcepackclientresponsepacket

Get alerted when CVE-2025-71417 or the next vulnerability affects your stack