Executive brief
PocketMine-MP is a Minecraft server software that handles player login requests. A vulnerability in its login packet processing allows attackers to send specially crafted login packets with deeply nested or extremely large data structures, causing the server to consume excessive memory and CPU resources, which can crash the server entirely.
Technical details
The vulnerability is a denial-of-service (DoS) issue in the LoginPacketHandler component due to improper handling of unknown properties in the clientData JWT body. When the JsonMapper processes unexpected properties in the JWT, it logs the property value without length limitations or sanitization using var_export(), which can serialize massive or deeply nested object structures. An unauthenticated, network-reachable attacker can send a malicious LoginPacket with large/complex data in an unknown clientData property, triggering out-of-memory conditions and crashing the server. The vulnerability was fixed in version 5.41.1 by removing the var_export call and limiting logged property names to 80 characters. This affects PocketMine-MP versions before 5.41.1.
Affected products
- PocketMine PocketMine-MP before 5.41.1
Timeline
- 2026-04-04: disclosed
- 2026-09-09: patched: Version 5.41.1 released