CyberRota Analysis
AI-GeneratedPocketMine-MP versions prior to 4.18.0-ALPHA2 are vulnerable to a denial-of-service attack due to inadequate rate limiting on InventoryTransactionPacket requests. This flaw allows attackers to exploit the server by sending numerous mismatched transactions, resulting in excessive bandwidth consumption from large serialized inventory data transfers without requiring authentication. Server administrators and developers using affected versions should prioritize patching to mitigate potential service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.