PocketMine-MP fails to rate‑limit mismatch type InventoryTransactionPacket requests, allowing an attacker to send a large number of such packets. Each packet triggers the server to synchronize inventory data, resulting in the server transmitting considerable amounts of serialized inventory data to the client. This excessive bandwidth consumption provides a bandwidth amplification denial‑of‑service vector without requiring any authentication.

PocketMine-MP servers running any version older than 4.18.0‑ALPHA2 are affected.

The vulnerability’s CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the weakness from the network as the lack of authentication on InventoryTransactionPacket allows a remote, unauthenticated user to flood the server with packets and drain network bandwidth, leading to denial of service.