CVE-2020-37277

CVE-2020-37277 is a denial-of-service vulnerability in PocketMine-MP, an open-source Minecraft: Pocket Edition/Bedrock Edition server platform, caused by uncontrolled resource consumption (CWE-400) in the InventoryTransaction component's findResultItem() method. An attacker who can connect as a client sends specially crafted InventoryTransactionPackets containing multiple conflicting transaction pathways, which forces the result-item search to process with exponential complexity. The practical impact is server-wide: the server freezes and all connected players are disrupted, with no confidentiality or integrity impact (CVSS 4.0 scores only availability at High, 7.1 overall). Anyone running PocketMine-MP versions before 3.15.4 is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a low 0.3% 30-day exploitation probability, so no exploitation is currently known.

What to do: Upgrade PocketMine-MP to version 3.15.4 or later; verify the running version with the /version server command. Operators who cannot upgrade immediately should restrict which clients can join (e.g., trusted networks or allowlists) and watch for server freezes coinciding with inventory-transaction packets from connected players.