GHSA-7m9r-rq9j-wmmh
PocketMine-MP vulnerable to denial-of-service by sending large modal form responses
Quick fix
GHSA-7m9r-rq9j-wmmh — pocketmine/pocketmine-mp: upgrade to the fixed version with the command below.
composer require pocketmine/pocketmine-mp:^4.12.5Details
### Impact Due to a workaround for an old client bug (which has since been fixed), very large JSON payloads in `ModalFormResponsePacket` were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the server from processing other connections in a timely manner.
### Patches The problem has been addressed in 3baa5ab71214f96e6e7ab12cb9beef08118473b5 by removing the workaround code.
### Workarounds Plugins could cancel `DataPacketReceiveEvent` for this packet, decode the data their way, and then call `Player->onFormSubmit()` directly, bypassing the vulnerable code.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 4.12.5composer require pocketmine/pocketmine-mp:^4.12.5