en
Pmmp is the open-source community behind PocketMine-MP, a PHP-based, highly configurable server for Minecraft: Bedrock Edition. It focuses on a plugin API, multi-world support, and a vibrant ecosystem that enables non-vanilla Bedrock server experiences for a global user base.
Severity across 29 analyzed records
The GCVE catalog currently lists 33 vulnerability records associated with pmmp.
Among the 29 records analyzed by CyStack, 18 are High or Critical and 0 appear in the CISA KEV catalog for priority remediation.
pmmp is the community-driven, open source project behind PocketMine-MP, a highly customizable server software for Minecraft: Bedrock Edition. It provides a PHP-based plugin API, multi-world support, and an ecosystem of community plugins for hosting non-vanilla Bedrock servers at scale. Operated as a collaborative project with global contributors, the project maintains extensive documentation and developer resources.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-86204PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket | Exploitation statusPublic exploit | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2026-86203PocketMine-MP before 5.39.2 Item Duplication via Despawn State | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2026-86202PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2026-86201PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2026-86200PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2026-86199PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login | Exploitation statusPublic exploit | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityLow |
CVE-2025-71418PocketMine-MP before 5.25.2 Denial of Service via explode | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2025-71417PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2024-58381PocketMine-MP before 5.11.1 Denial of Service via LoginPacket | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2024-58380PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2023-54396PocketMine-MP before 4.8.1 Server Crash via Banner NBT | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityHigh |
CVE-2023-54395PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2023-54394PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/09/2026 | SeverityMedium |
CVE-2023-54393PocketMine-MP before 4.20.5 Denial of Service via LoginPacket | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published09/09/2026 | SeverityHigh |
CVE-2023-54392PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published09/09/2026 | SeverityHigh |
CVE-2023-54390PocketMine-MP before 5.3.1 Denial of Service via LoginPacket | Exploitation statusNot known exploited | FixYes | Affected productNot confirmed | Published09/09/2026 | SeverityHigh |
CVE-2023-54355PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve | Exploitation statusNot known exploited | FixYes | Affected productNot confirmed | Published09/09/2026 | SeverityHigh |
CVE-2022-51018PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51017PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51016PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityMedium |
CVE-2022-51015PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51014PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51013PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51012PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51011PocketMine-MP before 4.2.10 Denial of Service via Chat Messages | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityMedium |
CVE-2022-51010PocketMine-MP before 4.4.2 Server Crash via Item ID | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/07/2026 | SeverityHigh |
CVE-2022-51009PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/06/2026 | SeverityHigh |
CVE-2022-51008PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/06/2026 | SeverityMedium |
CVE-2021-48007PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/06/2026 | SeverityHigh |
CVE-2021-48006PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity | Exploitation statusNot confirmed | FixYes | Affected productPocketMine-MP | Published09/06/2026 | SeverityMedium |
CVE-2020-37277PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published09/06/2026 | SeverityHigh |
CVE-2023-7332PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash | Exploitation statusNot known exploited | FixYes | Affected productPocketMine-MP | Published12/31/2025 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
