CVE-2025-71417

PocketMine-MP, an open-source Minecraft Bedrock Edition server, did not validate that pack UUIDs listed by a client in ResourcePackClientResponsePacket with STATUS_SEND_PACKS are unique before version 5.32.1. An authenticated player can list the same valid resource pack UUIDs multiple times in a single packet, causing the server to generate and transmit duplicate copies of those packs and consuming server memory. By repeatedly sending such crafted packets, the attacker can exhaust server memory and crash or stall the server, denying service to all connected players. Any operator running PocketMine-MP prior to 5.32.1 is exposed, since the attack requires only ordinary player-level access over the network. No public proof-of-concept or confirmed in-the-wild exploitation is known as of this writing.

What to do: Upgrade PocketMine-MP to version 5.32.1 or later, which validates pack UUID uniqueness. As interim mitigation, limit network access to trusted players since the attack requires an authenticated client, and monitor server memory usage for abnormal growth. Verify the running version from server startup logs before considering the issue closed.