Executive brief
PocketMine-MP is a popular open-source Minecraft server implementation. The server fails to properly validate the Certificate field during offline mode authentication, allowing unauthenticated players to crash the server by sending specially crafted login requests. This can result in service outages affecting all players on the affected server.
Technical details
The vulnerability is an uninitialized property access flaw in the offline login authentication mechanism. When processing login requests, the server fails to validate the Certificate field before accessing it, leading to a crash when the field is missing or malformed. The attack requires no authentication and is reachable over the network by any client attempting to connect. An attacker can trigger a denial-of-service condition by sending a crafted login packet with an invalid or missing certificate. The issue is fixed in version 5.43.1 and later.
Affected products
- PocketMine PocketMine-MP before 5.43.1
Timeline
- 2026-09-09: disclosed
- 2026-05-09: patched: Fix released in version 5.43.1