CyberRota Analysis
AI-GeneratedPocketMine-MP versions prior to 4.12.3 are vulnerable to session exhaustion attacks due to inadequate limits on unauthenticated sessions, enabling attackers to create multiple connections without authentication. This can lead to denial of service, as the server's player slots become occupied, blocking legitimate users from accessing the game. Server administrators and operators should prioritize this vulnerability to ensure availability for legitimate players.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.