PocketMine-MP versions prior to 4.2.10 do not check the overall length of incoming chat packets before dividing them by newline characters. An attacker can send a single, megabyte‑sized chat packet that contains thousands of newline separators, forcing the server to create a very large list of message fragments. The excessive processing time and memory consumption can cause the server to lock up for seconds or even minutes, resulting in a denial of service for all connected players. This weakness is an input validation flaw (CWE‑20).

Any PocketMine‑MP instance running a version earlier than 4.2.10 is vulnerable, regardless of the specific patch level installed. The vulnerability is present in all forks that have not applied the upstream fix.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The exploit probability is not quantified by EPSS and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a remote attacker who can connect to the game server and send arbitrary chat messages; no special privileges are required. Once exploited, the attacker can repeatedly flood the server with large packets, overwhelming the message handling subsystem and causing service interruption.