This repository was archived by the owner on Jul 9, 2026. It is now read-only.
Security: pmmp/PocketMine-MP
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Improper handling of async conditions in ResourcePackClientResponsePacket STATUS_COMPLETED handlingGHSA-pg53-p7qp-65cv published
Jun 24, 2026 by dktappsLow -
Improper handling of new offline login flowGHSA-g2fj-p69p-9chp published
May 24, 2026 by dktappsHigh -
LogDoS by many junk properties in client data JWT in `LoginPacket`GHSA-xp4f-g2cm-rhg7 published
Apr 14, 2026 by dktappsModerate -
LogDoS by large complex unknown property logging in clientData in LoginPacketGHSA-h6rj-3m53-887h published
Apr 4, 2026 by dktappsHigh -
Network amplification vulnerability with `ActorEventPacket`GHSA-7hmv-4j2j-pp6f published
Apr 4, 2026 by dktappsModerate -
Player entities can still die and drop items in flaggedForDespawn stateGHSA-f9jp-856v-8642 published
Apr 4, 2026 by dktappsLow -
`ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checkingGHSA-fqqv-56h5-f57g published
Aug 30, 2025 by dktappsHigh -
JSON decoding of unlimited size large arrays/objects in ModalFormResponse HandlingGHSA-788v-5pfp-93ff published
Apr 4, 2026 by dktappsHigh -
Malicious client data wasting server resources due to lack of limits for explode()GHSA-g274-c6jj-h78p published
Mar 9, 2025 by dktappsModerate -
BookEditPacket crash when inventory slot in the packet is invalidGHSA-xc7j-wj36-qjfr published
Mar 5, 2024 by dktappsModerate