PocketMine-MP Improper Input Validation in Inventory Handling Leading to Server Crash

A denial-of-service vulnerability has been identified in PocketMine-MP versions prior to 4.18.1. The issue arises from improper input validation in inventory transaction management. A remote attacker with a valid player session can exploit this vulnerability by requesting the server to drop more items than are available in the player's hotbar. This exploitation triggers a server crash, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a server crash, causing a denial-of-service condition.

Remediation

Users can update to PocketMine-MP version 4.18.1 or later to address this vulnerability.