Logging of Excessive Data Affecting pocketmine/pocketmine-mp package, versions <5.41.1
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-POCKETMINEPOCKETMINEMP-15920430
- published7 Apr 2026
- disclosed6 Apr 2026
- creditArkadiaEU
Introduced: 6 Apr 2026
CVE NOT AVAILABLE CWE-779 (opens in a new tab)How to fix?
Upgrade pocketmine/pocketmine-mp to version 5.41.1 or higher.
Overview
pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP
Affected versions of this package are vulnerable to Logging of Excessive Data through the processing of unexpected properties in the clientData of the LoginPacket. An attacker can exhaust server resources and potentially cause a crash by sending a specially crafted packet containing large or deeply nested JSON structures, resulting in excessive logging and CPU usage.
Workaround
This vulnerability can be mitigated by handling DataPacketReceiveEvent to capture LoginPacket and pre-processing the JWT to reject unusual properties, such as by setting the bExceptionOnUndefinedProperty flag to true in JsonMapper.