Security
فارسی
All products

pocketmine/pocketmine-mp

Composer · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packetsCVE-2026-86198 · GHSA-PG53-P7QP-65CV pocketmine/pocketmine-mp Composer Low Fix reported
PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKeyCVE-2023-54355 · GHSA-79RC-JJH6-RC89 pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacketCVE-2026-86201 · GHSA-H6RJ-3M53-887H pocketmine/pocketmine-mp Composer High Fix reported
PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'CVE-2023-54394 · GHSA-42QM-8V8M-M78C pocketmine/pocketmine-mp Composer Medium Fix reported
PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crashCVE-2023-54396 · GHSA-WQQV-JCFR-9F5G pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)CVE-2024-58381 · GHSA-H6J3-J35F-V2X7 pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalidCVE-2024-58380 · GHSA-XC7J-WJ36-QJFR pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn stateCVE-2026-86203 · GHSA-F9JP-856V-8642 pocketmine/pocketmine-mp Composer Low Fix reported
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)CVE-2023-54390 · GHSA-92JH-GWCH-JQ38 pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependencyCVE-2023-54393 · GHSA-PQP3-8RRW-G8VM pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacketCVE-2023-54392 · GHSA-7WRV-6H42-W54F pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP vulnerable to denial-of-service by sending large modal form responsesCVE-2023-54395 · GHSA-7M9R-RQ9J-WMMH pocketmine/pocketmine-mp Composer Medium Fix reported
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacketCVE-2026-86200 · GHSA-XP4F-G2CM-RHG7 pocketmine/pocketmine-mp Composer Medium Fix reported
PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`CVE-2026-86202 · GHSA-7HMV-4J2J-PP6F pocketmine/pocketmine-mp Composer Medium Fix reported
PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse HandlingCVE-2026-86204 · GHSA-788V-5PFP-93FF pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checkingCVE-2025-71417 · GHSA-FQQV-56H5-F57G pocketmine/pocketmine-mp Composer High Fix reported
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()CVE-2025-71418 · GHSA-G274-C6JJ-H78P pocketmine/pocketmine-mp Composer Medium Fix reported
PocketMine-MP invalid skin geometry JSON data leading to server crashCVE-2022-51009 · GHSA-8CWQ-4CMF-PX73 pocketmine/pocketmine-mp Composer High Fix reported
Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MPCVE-2022-51016 · GHSA-H79X-98R2-G6QC pocketmine/pocketmine-mp Composer Medium Fix reported
Unhandled exception when decoding form response JSONCVE-2022-51014 · GHSA-WJFQ-88Q2-R34J pocketmine/pocketmine-mp Composer High Fix reported