# pocketmine/pocketmine-mp (Packagist) vulnerabilities 31 known vulnerabilities (21 high, 9 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/pocketmine/pocketmine-mp ## Advisories (31) ### [CVE-2026-86204](https://cve.now/CVE-2026-86204): PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket - Severity: High 7.1 - Published: Sep 9, 2026 - Affected: fixed in 5.39.2. ### [CVE-2026-86203](https://cve.now/CVE-2026-86203): PocketMine-MP before 5.39.2 Item Duplication via Despawn State - Severity: Medium 6.3 - Published: Sep 9, 2026 - Affected: fixed in 5.39.2. ### [CVE-2026-86202](https://cve.now/CVE-2026-86202): PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket - Severity: Medium 5.3 - Published: Sep 9, 2026 - Affected: fixed in 5.39.2. ### [CVE-2026-86201](https://cve.now/CVE-2026-86201): PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData - Severity: High 8.7 - Published: Sep 9, 2026 - Affected: fixed in 5.41.1. ### [CVE-2026-86200](https://cve.now/CVE-2026-86200): PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT - Severity: Medium 6.9 - Published: Sep 9, 2026 - Affected: fixed in 5.42.1. ### [CVE-2026-86198](https://cve.now/CVE-2026-86198): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket - Severity: Low 2.3 - Published: Sep 9, 2026 - Affected: fixed in 5.44.2. ### [CVE-2025-71418](https://cve.now/CVE-2025-71418): PocketMine-MP before 5.25.2 Denial of Service via explode - Severity: Medium 6.9 - Published: Sep 9, 2026 - Affected: fixed in 5.25.2. ### [CVE-2025-71417](https://cve.now/CVE-2025-71417): PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket - Severity: High 7.1 - Published: Sep 9, 2026 - Affected: fixed in 5.32.1. ### [CVE-2024-58381](https://cve.now/CVE-2024-58381): PocketMine-MP before 5.11.1 Denial of Service via LoginPacket - Severity: High 8.7 - Published: Sep 9, 2026 - Affected: fixed in 5.11.1. ### [CVE-2024-58380](https://cve.now/CVE-2024-58380): PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket - Severity: High 7.1 - Published: Sep 9, 2026 - Affected: fixed in 5.11.2. ### [CVE-2023-54396](https://cve.now/CVE-2023-54396): PocketMine-MP before 4.8.1 Server Crash via Banner NBT - Severity: High 7.1 - Published: Sep 9, 2026 - Affected: fixed in 4.8.1. ### [CVE-2023-54395](https://cve.now/CVE-2023-54395): PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket - Severity: Medium 5.3 - Published: Sep 9, 2026 - Affected: fixed in 4.12.5. ### [CVE-2023-54394](https://cve.now/CVE-2023-54394): PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket - Severity: Medium 5.3 - Published: Sep 9, 2026 - Affected: fixed in 4.18.0-ALPHA2. ### [CVE-2023-54393](https://cve.now/CVE-2023-54393): PocketMine-MP before 4.20.5 Denial of Service via LoginPacket - Severity: High 8.7 - Published: Sep 9, 2026 - Affected: fixed in 4.20.5; from 4.21.0, fixed in 4.21.1. ### [CVE-2023-54392](https://cve.now/CVE-2023-54392): PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket - Severity: High 7.1 - Published: Sep 9, 2026 - Affected: from 4.20.0, fixed in 4.22.3; from 5.0.0, fixed in 5.2.1. ### [CVE-2023-54390](https://cve.now/CVE-2023-54390): PocketMine-MP before 5.3.1 Denial of Service via LoginPacket - Severity: High 8.7 - Published: Sep 9, 2026 - Affected: from 5.0.0, fixed in 5.3.1; fixed in 4.23.1. ### [CVE-2023-54355](https://cve.now/CVE-2023-54355): PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve - Severity: High 8.7 - Published: Sep 9, 2026 - Affected: from 5.2.0, fixed in 5.3.1. ### [CVE-2022-51018](https://cve.now/CVE-2022-51018): PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: fixed in 3.26.5; from 4.0.0, fixed in 4.0.5. ### [CVE-2022-51017](https://cve.now/CVE-2022-51017): PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data - Severity: High 8.7 - Published: Sep 7, 2026 - Affected: fixed in 3.26.5; from 4.0.0, fixed in 4.0.5. ### [CVE-2022-51016](https://cve.now/CVE-2022-51016): PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay - Severity: Medium 5.3 - Published: Sep 7, 2026 - Affected: from 3.0.0, fixed in 4.0.0. ### [CVE-2022-51015](https://cve.now/CVE-2022-51015): PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: fixed in 4.0.6. ### [CVE-2022-51014](https://cve.now/CVE-2022-51014): PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: from 4.0.0, fixed in 4.0.7. ### [CVE-2022-51013](https://cve.now/CVE-2022-51013): PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: fixed in 4.2.4. ### [CVE-2022-51012](https://cve.now/CVE-2022-51012): PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: fixed in 4.2.9. ### [CVE-2022-51011](https://cve.now/CVE-2022-51011): PocketMine-MP before 4.2.10 Denial of Service via Chat Messages - Severity: Medium 5.3 - Published: Sep 7, 2026 - Affected: fixed in 4.2.10. ### [CVE-2022-51010](https://cve.now/CVE-2022-51010): PocketMine-MP before 4.4.2 Server Crash via Item ID - Severity: High 7.1 - Published: Sep 7, 2026 - Affected: from 4.0.0-BETA5, fixed in 4.4.2. ### [CVE-2022-51009](https://cve.now/CVE-2022-51009): PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry - Severity: High 8.7 - Published: Sep 6, 2026 - Affected: fixed in 4.7.2. ### [CVE-2021-48007](https://cve.now/CVE-2021-48007): PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket - Severity: High 7.1 - Published: Sep 6, 2026 - Affected: fixed in 3.18.1. ### [CVE-2021-48006](https://cve.now/CVE-2021-48006): PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity - Severity: Medium 4.8 - Published: Sep 6, 2026 - Affected: fixed in 4.0.3. ### [CVE-2020-37277](https://cve.now/CVE-2020-37277): PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction - Severity: High 7.1 - Published: Sep 6, 2026 - Affected: fixed in 3.15.4. ### [CVE-2023-7332](https://cve.now/CVE-2023-7332): PocketMine-MP \< 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash - Severity: High 7.1 - Published: Dec 31, 2025 - Affected: fixed in 4.18.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/pocketmine/pocketmine-mp Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.