PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets (CVE-2026-86198)

Package: pocketmine/pocketmine-mp
Fixed in: 5.44.2
Published: Thu 29 Oct 2026, 16:32 Lisbon
Installs on Packagist: 82K

In plain words

A malicious client can cause the server to repeat pre-spawn processing during the resource pack stage of login. This can create multiple player objects for one session, increasing memory use and outbound network traffic.

Affected versions

Package	Affected	Fixed in
pocketmine/pocketmine-mp	< 5.44.2	5.44.2

Am I affected?

Look for pocketmine/pocketmine-mp in composer.lock and check whether its version is below 5.44.2. The issue occurs during resource pack handling at login; the advisory names no optional configuration or database condition to check. Version 5.44.2 contains the fix.

What to do

Check which version you have, then update to a fixed release for your branch (5.44.2):

composer show pocketmine/pocketmine-mp | grep versions
composer update pocketmine/pocketmine-mp

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Plugins can use their own PacketHandler classes to reject or ignore extra ResourcePackClientResponsePacket packets.

The advisory's description

Summary

During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.

Impact

Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.

Workarounds

Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.

Patches

This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

Weakness: CWE-837 Improper Enforcement of a Single, Unique Action. Reported by Genesizs, dktapps.

The advisory

GitHub Advisory Database: GHSA-pg53-p7qp-65cv, with who is affected and how
OSV.dev: GHSA-pg53-p7qp-65cv
All advisories for pocketmine/pocketmine-mp

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.