CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CGA-RFPX-9R7H-CGX9

Bulletin has no description...

EUVD-2026-74909

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 are vulnerable to a denial-of-service condition in the resource pack handling subsystem. The root cause is a failure to properly validate multiple ResourcePackClientResponsePacket packets carrying the STATUS_COMPLETED status, which allows malicious clients to ...

CGA-7RF5-FJFF-CMF8

Bulletin has no description...

CGA-PG26-C2GR-26QG

Bulletin has no description...

CGA-XQ4F-32QV-279P

Bulletin has no description...

CGA-FFJP-MMWP-CF29

Bulletin has no description...

CGA-VWHH-5PRM-RQX8

Bulletin has no description...

CGA-4695-XP3H-MWCG

Bulletin has no description...

CGA-VG98-GJ5J-F99P

Bulletin has no description...

CGA-4H3X-M98M-HQ8V

Bulletin has no description...

CGA-HRGQ-8498-6QCR

Bulletin has no description...

CGA-8RQP-QFWX-6V7R

Bulletin has no description...

CGA-FMQ6-WHQP-4252

Bulletin has no description...

CVE-2025-71418

PocketMine-MP versions before 5.25.2 are vulnerable to a denial of service caused by an unbounded explode() function during packet parsing. A remote, unauthenticated attacker can send crafted packets containing excessive delimiters to exhaust CPU and memory resources. The affected parsing endpoin...

CVE-2025-71418 PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2025-71418 PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...