pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory

Impact A client can send reliable-ordered packets 0, 2, 3, 4, 5 ... etc, and all the packets 2 and up will stay in the reliable-ordered queue until 1 arrives. A malicious client can exploit this to waste all available server memory by simply never sending the missing packet. Since the server...

PT-2023-33065

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 0.14.x and 0.15.x Description A malicious client can exploit a issue by sending reliable-ordered packets in a way that causes all packets, except the first one, to stay in the reliable-ordered queue until the missin...