GHSA-pg53-p7qp-65cv - PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
### Summary
During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression.
### Impact
Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`.
### Workarounds
Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets.
### Patches
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
LOW
Severity & confidence
Source severitylow
Platform severitylow
Confidencemedium
Exploitationunknown
CVSS-
Affected
Vendorspocketmine
Productspocketmine/pocketmine-mp
Reporting sources (1)
GitHub Security Advisories
Timeline & provenance
Published2026-10-29T16:32:58
Last updated2026-11-03T17:16:27
Ingested2026-10-29T16:43:22
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories
