Improper Control of a Resource Through its Lifetime Affecting pocketmine/pocketmine-mp package, versions <5.39.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-POCKETMINEPOCKETMINEMP-15920416
- published7 Apr 2026
- disclosed6 Apr 2026
- creditkostamax27
Introduced: 6 Apr 2026
CVE NOT AVAILABLE CWE-664 (opens in a new tab)How to fix?
Upgrade pocketmine/pocketmine-mp to version 5.39.2 or higher.
Overview
pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP
Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime in the process handling entity state transitions. An attacker can cause item duplication by exploiting a race condition where a player entity is attacked and killed during the disconnect sequence, resulting in the entity's inventory being dropped while the player retains their items upon reconnecting.
Workaround
This vulnerability can be mitigated by handling the EntityDamageByEntityEvent in plugins, checking if the victim entity is flagged for despawn, and cancelling the event if so.