Pmmp vulnerabilities
We track 9 vulnerabilities in Pmmp products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Pmmp vulnerabilities
- 7.5 High severity
PocketMine-MP: Uncontrolled Resource Consumption
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with d
- 7.5 High severity
PocketMine-MP: Incomplete List of Disallowed Inputs
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
- 7.5 High severity
PocketMine-MP: Deserialization of Untrusted Data
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types t
- 7.5 High severity
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket…
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
- 7.5 High severity
PocketMine-MP: Comparison Using Wrong Factors
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the serv
- 7.5 High severity
PocketMine-MP: Improper Verification of Cryptographic Signature
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verifica
- 7.5 High severity
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields…
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName
- 7.5 High severity
PocketMine-MP: Uncaught Exception
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server
- 7.1 High severity
PocketMine-MP: Improper Validation of Specified Quantity in Input
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, tr