Cloudanix VulnDB

GHSA-7hmv-4j2j-pp6f

Medium · 4.3

PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

CVSS

4.3

EPSS

—

Published

Apr 6, 2026

CISA due date

—

The record

The server handles `ActorEventPacket` to trigger consuming animations from vanilla clients when they eat food or drink potions. This can be abused to make the server spam other clients, and to waste server CPU and memory. For every `ActorEventPacket` sent by the client, an animation event will be sent to every other player the attacker is visible to. This is similar to various other vulnerabilities which were fixed in the network overhaul of PM4 (e.g. `AnimatePacket` and `LevelSoundEventPacket`), but somehow this one slipped through the net.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities