PocketMine-MP denial of service via junk properties in LoginPacket

Executive brief

PocketMine-MP, a popular server software for Minecraft: Bedrock Edition, is vulnerable to a denial-of-service attack. Attackers can send specially crafted login data containing excessive unnecessary information, causing the server to waste processing power and flood its logs with warning messages. This can lead to server instability or performance degradation for legitimate players.

Technical details

A vulnerability exists in the LoginPacketHandler of PocketMine-MP where the JsonMapper instance used to process the clientData JWT is configured to issue warnings for unexpected properties rather than rejecting them. An unauthenticated remote attacker can exploit this by sending a LoginPacket containing a JWT with a large number of junk properties. This triggers excessive logging and consumes CPU cycles, leading to a denial-of-service condition. The issue was addressed in version 5.42.1 by limiting the number of allowed unknown properties to 10 and rejecting packets that exceed this threshold.

Affected products

• pmmp PocketMine-MP < 5.42.1

Timeline

• 2026-04-14: disclosed
• 2026-04-15: advisory
• 2026-04-15: patched

References

• https://api.github.com/users/DrakzoSurYT
• https://github.com/DrakzoSurYT
• https://api.github.com/users/DrakzoSurYT/gists%7B/gist_id%7D
• https://api.github.com/users/DrakzoSurYT/repos
• https://avatars.githubusercontent.com/u/60445550?v=4
• https://api.github.com/users/DrakzoSurYT/events%7B/privacy%7D