PocketMine-MP versions earlier than 3.15.4 contain a flaw in the InventoryTransaction component’s findResultItem() method that allows an attacker to trigger a denial of service. By sending specially crafted InventoryTransactionPackets with multiple conflicting pathways, a client can cause the server to perform exponential processing, ultimately freezing it and making the game world unavailable to legitimate players. The weakness is a classic resource exhaustion issue as identified by CWE-400.

The vulnerability affects PocketMine-MP servers running any version prior to 3.15.4. All installations of the open‑source Minecraft Bedrock server software that have not applied the 3.15.4 release or the upstream patch are potentially impacted.

With a CVSS score of 7.1, the vulnerability represents a high severity risk, but the EPSS score is unavailable and the vulnerability is not listed in CISA's KEV catalog. Attackers can gain remote access by connecting to the server and sending malicious packets, exploiting the server’s lack of input validation in the InventoryTransaction logic. The denial of service could disrupt game sessions for all players on the affected server, but it does not grant direct code execution or data exfiltration.