PocketMine-MP versions prior to 4.12.5 contain a flaw in the processing of ModalFormResponsePacket messages that allows an attacker to cause service interruption. By sending large JSON payloads in these packets, a malicious client can overload server resources, consume CPU time, and prevent legitimate players from connecting. The weakness is a resource exhaustion issue (CWE-407).

Any PocketMine-MP server running a version older than 4.12.5 is vulnerable. This includes the default builds distributed under the pmmp product line. No specific sub‑versions are listed beyond the overall pre‑4.12.5 threshold.

The CVSS score of 5.3 indicates moderate severity, and the exploit probability appears low since the EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is remote network access: an attacker must be able to connect to the server and send a large ModalFormResponsePacket. Once the packet is processed, the server’s CPU and memory usage spike, leading to a denial of legitimate connections. The vulnerability does not require privileged access or vulnerable client software beyond a malformed packet. The risk persists until a patched server version is deployed.