Composer pocketmine/pocketmine-mp has 30 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-58381 | PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time) | high | 7.5 | <5.11.1 | 5.11.1 |
| CVE-2022-51015 | Unchecked validity of Facing values in PlayerActionPacket | high | 7.5 | <4.0.6 | 4.0.6 |
| CVE-2026-86200 | PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | medium | 0.0 | <5.42.1 | 5.42.1 |
| CVE-2022-51017 | Uncapped length of skin data fields submitted by players | high | 7.5 | <3.26.5 or >=4.0.0 and <4.0.5 | 3.26.5, 4.0.5 |
| CVE-2023-54393 | PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency | high | 7.5 | <4.20.5 or >=4.21.0 and <4.21.1 | 4.20.5, 4.21.1 |
| CVE-2022-51009 | PocketMine-MP invalid skin geometry JSON data leading to server crash | high | 7.5 | <4.7.2 | 4.7.2 |
| CVE-2023-54390 | PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) | high | 7.5 | >=5.0.0 and <5.3.1 or <4.23.1 | 5.3.1, 4.23.1 |
| CVE-2026-86201 | PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | high | 7.5 | <5.41.1 | 5.41.1 |
| CVE-2025-71418 | PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | medium | 5.3 | <5.25.2 | 5.25.2 |
| CVE-2023-54394 | PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' | medium | 5.3 | <4.18.0-ALPHA2 | 4.18.0-ALPHA2 |
| CVE-2021-48007 | NaN/INF in serverbound movement packets can crash clients and servers | high | 7.5 | <3.18.1 | 3.18.1 |
| CVE-2022-51010 | Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP | high | 7.5 | >=4.0.0-BETA5 and <4.4.2 | 4.4.2 |
| CVE-2022-51012 | Insufficient type validation in pocketmine/pocketmine-mp | high | 7.5 | <4.2.9 | 4.2.9 |
| CVE-2022-51013 | Improperly checked metadata on tools/armour itemstacks received from the client | high | 7.5 | <4.2.4 | 4.2.4 |
| CVE-2022-51014 | Unhandled exception when decoding form response JSON | high | 7.5 | >=4.0.0 and <4.0.7 | 4.0.7 |
| CVE-2023-54392 | PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket | high | 7.5 | >=4.20.0 and <4.22.3 or >=5.0.0 and <5.2.1 | 4.22.3, 5.2.1 |
| CVE-2023-54396 | PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash | high | 7.5 | <4.8.1 | 4.8.1 |
| CVE-2024-58380 | PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid | high | 7.5 | <5.11.2 | 5.11.2 |
| CVE-2020-37277 | Exploitable inventory component chaining in PocketMine-MP | high | 0.0 | <3.15.4 | 3.15.4 |
| CVE-2022-51011 | Denial-of-service vulnerability processing large chat messages containing many newlines | medium | 5.3 | <4.2.10 | 4.2.10 |
| CVE-2023-54395 | PocketMine-MP vulnerable to denial-of-service by sending large modal form responses | medium | 5.3 | <4.12.5 | 4.12.5 |
| CVE-2022-51018 | Book page text, count, and author/title length is not limited in PocketMine-MP | medium | 6.5 | <3.26.5 or >=4.0.0 and <4.0.5 | 3.26.5, 4.0.5 |
| CVE-2025-71417 | PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | high | 0.0 | <5.32.1 | 5.32.1 |
| CVE-2026-86204 | PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | high | 0.0 | <5.39.2 | 5.39.2 |
| CVE-2023-7332 | PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash | high | 7.5 | <4.18.1 | 4.18.1 |
| CVE-2023-54355 | PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey | high | 7.5 | >=5.2.0 and <5.3.1 | 5.3.1 |
| CVE-2026-86202 | PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` | medium | 4.3 | <5.39.2 | 5.39.2 |
| CVE-2026-86203 | PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state | low | 3.7 | <5.39.2 | 5.39.2 |
| CVE-2022-51016 | Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP | medium | 4.7 | >=3.0.0 and <4.0.0 | 4.0.0 |
| CVE-2021-48006 | Inability to de-op players if listed in ops.txt with non-lowercase letters | low | 3.3 | <4.0.3 | 4.0.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked