PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact Attackers can put large and/or complex structures as a value to an unknown property in the clientData JWT body in the Minecraft LoginPacket, causing the server to generate very long log messages. Additionally, the property name is logged without any length limitations or sanitization, which can also be abused for LogDoS. This may be used to spam the log/console, waste CPU time serializing the offending structure, and potentially to crash the server entirely. This happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them outright. While this behaviour increases flexibility for random changes introduced by Microsoft, it also creates vulnerabilities if not handled carefully. This vulnerability affects PocketMine-MP servers exposed to a public network where unknown actors may have access. PoC 1. Connect to the server using a custom client. 2. Send a Minecraft LoginPacket containing an unexpected…

Published by the source

6 Apr 2026, 22:54 UTC

Last modified by the source

6 Apr 2026, 22:54 UTC

Source last checked

26 Oct 2026, 14:39 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-h6rj-3m53-887h

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-h6rj-3m53-887h

Advisory: PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
IDs: GHSA-h6rj-3m53-887h
Record: https://patchnext.com/advisories/ghsa-h6rj-3m53-887h (revision 1, source checked 26 Oct 2026, 14:39 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: pocketmine/pocketmine-mp 5.41.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist pocketmine/pocketmine-mp: affected < 5.41.1; fixed in 5.41.1

## Suggested inspection (read-only)
- Packagist pocketmine/pocketmine-mp: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pocketmine/pocketmine-mp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-h6rj-3m53-887h (GitHub-reviewed advisory GHSA-h6rj-3m53-887h lists affected ranges: Packagist pocketmine/pocketmine-mp >=0 <5.41.1)

Commands are suggestions: review each one before running it.