Logging of Excessive Data Affecting pocketmine/pocketmine-mp package, versions <5.42.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-POCKETMINEPOCKETMINEMP-16109591
- published19 Apr 2026
- disclosed15 Apr 2026
- creditDrakzoSurYT
Introduced: 15 Apr 2026
CVE NOT AVAILABLE CWE-779 (opens in a new tab)How to fix?
Upgrade pocketmine/pocketmine-mp to version 5.42.1 or higher.
Overview
pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP
Affected versions of this package are vulnerable to Logging of Excessive Data through the processing of client data JWTs in LoginPacket. An attacker can cause excessive warning messages and increased CPU usage by sending JWTs with numerous unexpected properties. This is only exploitable if the server is exposed to a public network where unknown actors may have access.
Workaround
This vulnerability can be mitigated by handling DataPacketReceiveEvent to capture LoginPacket and pre-processing the clientData JWT to ensure it does not contain unusual properties, such as by configuring JsonMapper to throw exceptions on undefined properties.