CVE-2020-37277: PocketMine-MP DoS Vulnerability

CVE-2020-37277 Overview

CVE-2020-37277 is a denial of service vulnerability in PocketMine-MP versions before 3.15.4. The flaw resides in the findResultItem() method of the InventoryTransaction component. A malicious authenticated client can send crafted InventoryTransactionPacket messages containing multiple conflicting slot-change pathways. These conflicting actions trigger recursive evaluation with exponential complexity, freezing the server process. The issue is tracked as CWE-400: Uncontrolled Resource Consumption and documented in GitHub Security Advisory GHSA-8jq6-w5cg-wm45.

Critical Impact
A single authenticated player can freeze a PocketMine-MP server by submitting an inventory transaction with multiple conflicting action chains, resulting in full availability loss for all connected users.

Affected Products

PocketMine-MP versions prior to 3.15.4
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Any deployment exposing the PocketMine-MP network protocol to untrusted clients

Discovery Timeline

2026-09-06 - CVE-2020-37277 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2020-37277

Vulnerability Analysis

The vulnerability sits in src/pocketmine/inventory/transaction/InventoryTransaction.php. The findResultItem() method attempts to reconstruct the resulting item from a chain of inventory actions by recursively matching source items against candidate actions. When multiple actions in the list share the same source item, the original implementation recursed into every possible pathway. Attackers who submit InventoryTransactionPacket messages containing many ambiguous slot changes force the server to explore an exponential number of chain permutations, consuming CPU time until the main game loop stalls.

Root Cause

The root cause is unbounded recursive exploration of ambiguous action graphs without deduplication or a cutoff for multiple matching candidates. Because each match spawned a recursive call over a shrinking-but-still-branching list, worst-case complexity grew factorially with the number of conflicting actions.

Attack Vector

Exploitation requires network access and a valid client session on the target server. The attacker crafts a single InventoryTransactionPacket whose action list contains multiple entries with identical getSourceItem() values. Processing that packet on the server thread blocks all other players, effectively taking the server offline without crashing the process.

php

// Patch: src/pocketmine/inventory/transaction/InventoryTransaction.php
protected function findResultItem(Item $needOrigin, array $possibleActions) : ?Item{
    assert(count($possibleActions) > 0);

    $candidate = null;
    $newList = $possibleActions;
    foreach($possibleActions as $i => $action){
        if($action->getSourceItem()->equalsExact($needOrigin)){
            if($candidate !== null){
                /*
                 * we found multiple possible actions that match the origin action
                 * this means that there are multiple ways that this chain could play out
                 * ... high complexity, not worth the trouble for this scenario ...
                 */
                return null;
            }
            $candidate = $action;
            unset($newList[$i]);
        }
    }
}
// Source: https://github.com/pmmp/PocketMine-MP/commit/c368ebb5e74632bc622534b37cd1447b97281e20

The patch replaces the recursive branching with a single-candidate check. When more than one action matches the origin item, the function returns null immediately instead of exploring every permutation.

Detection Methods for CVE-2020-37277

Indicators of Compromise

Sustained 100% CPU utilization on the PocketMine-MP server process following receipt of an InventoryTransactionPacket.
Server tick rate collapsing to near zero while the network thread remains responsive.
Client disconnects with timeout errors while the server process is still running.
Log entries referencing InventoryTransaction processing immediately preceding the freeze.

Detection Strategies

Monitor PocketMine-MP tick duration metrics and alert when tick times exceed normal thresholds for extended periods.
Instrument the InventoryTransaction code path to log action counts per packet, flagging packets with unusually large or duplicated action lists.
Inspect network captures for InventoryTransactionPacket payloads with repeated identical source item entries.

Monitoring Recommendations

Ship server process metrics (CPU, tick lag, thread state) into a centralized logging platform for correlation.
Track per-player packet rates and payload sizes to identify clients issuing anomalous inventory transactions.
Alert on repeated player-triggered server hangs originating from the same account or IP address.

How to Mitigate CVE-2020-37277

Immediate Actions Required

Upgrade PocketMine-MP to version 3.15.4 or later on all production and staging servers.
Audit deployed plugin builds to confirm none pin an older PocketMine-MP core version.
Restrict server access to trusted players using a whitelist while patching is in progress.
Review recent server hang events for evidence of prior exploitation attempts.

Patch Information

The fix is committed in pmmp/PocketMine-MP@c368ebb and shipped in release 3.15.4. Details are published in GHSA-8jq6-w5cg-wm45 and the VulnCheck advisory. The patch short-circuits findResultItem() when multiple actions share the same source item, eliminating the exponential recursion path.

Workarounds

Enable server whitelisting to limit inventory transactions to trusted players until the upgrade is applied.
Deploy a reverse proxy or firewall rule to rate-limit connections from untrusted networks.
Run the server under a process supervisor that restarts on prolonged tick lag to reduce downtime during exploitation.

bash

# Upgrade PocketMine-MP to a patched release
cd /opt/pocketmine-mp
./start.sh --version   # confirm current version

# Fetch the patched 3.15.4 (or later) build per project instructions
wget https://github.com/pmmp/PocketMine-MP/releases/download/3.15.4/PocketMine-MP.phar -O PocketMine-MP.phar

# Restart the server
systemctl restart pocketmine-mp