This vulnerability originates from PocketMine‑MP failing to enforce uniqueness of resource pack UUIDs during the handling of ResourcePackClientResponsePacket. Because the server accepts duplicate UUIDs, an authenticated client can send a packet containing the same pack identifier multiple times, forcing the server to process and store each instance. The resulting memory consumption can grow uncontrollably, leading to a denial of service that may bring the entire server down. The flaw is a classic input validation weakness (CWE‑20).

The issue affects PocketMine‑MP versions earlier than 5.32.1. All installations running pmmp:PocketMine‑MP before 5.32.1 are susceptible, regardless of the specific minor version, as the packet validation logic was not updated until 5.32.1.

The CVSS score of 7.1 indicates a high severity, but the EPSS value is not available, suggesting the exploitation probability has not been quantified yet. The vulnerability is not listed in CISA KEV, so no known active exploitation campaigns have been reported. Attackers would need authenticated access to the server; however, once authorized, crafting a malicious ResourcePackClientResponsePacket is straightforward, and the duplicate UUID mechanism can be triggered with minimal effort, causing a rapid exhaustion of server memory and resulting in service interruption.