CVE-2025-71417

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.32.1

Description An issue exists in the handling of STATUS SEND PACKS within the ResourcePackClientResponsePacket where the software fails to validate the uniqueness of pack UUIDs. An authenticated client using a non-standard Bedrock client can send a packet containing multiple duplicate valid pack UUIDs in the packIds array. This causes the server to process and send the same resource pack multiple times, leading to rapid memory exhaustion and a resulting denial of service that can freeze or crash the server.

Recommendations Update to version 5.32.1 or later. As a temporary mitigation, restrict the use of the packIds array in the ResourcePackClientResponsePacket by implementing a check to remove duplicates or disconnect clients that send excessive duplicate requests.