CVE-2020-37277
Received Received - Intake

Denial of Service in PocketMine-MP via InventoryTransactionPacket

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulnCheck

Description
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2020-37277
EUVD
EUVD-2020-31270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pocketmine-mp pocketmine-mp to 3.15.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in PocketMine-MP versions before 3.15.4. It exists in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted packets with conflicting pathways that cause exponential processing complexity, freezing the server.

Detection Guidance

Monitor server logs for unusually high processing times during inventory transactions or frequent freezes. Check for incoming InventoryTransactionPackets with multiple conflicting pathways. Use network monitoring tools to detect abnormal traffic patterns targeting the PocketMine-MP server.

Impact Analysis

If exploited, this vulnerability can freeze or crash PocketMine-MP servers by overwhelming the server's processing capacity. This disrupts normal server operations and can lead to downtime for players and services relying on the server.

Compliance Impact

This vulnerability primarily causes server downtime through denial-of-service attacks, which could impact compliance with standards requiring high availability like GDPR (data processing continuity) or HIPAA (system reliability for healthcare data). However, the provided context does not explicitly link this issue to specific compliance requirements.

Mitigation Strategies

Upgrade PocketMine-MP to version 3.15.4 or later immediately. If upgrading is not possible, implement a plugin that listens to DataPacketReceiveEvent to filter malicious packets. Block or restrict network access to the server until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-37277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart