Time-of-check Time-of-use (TOCTOU) Race Condition in PocketMine-MP - #VU125430
Published: April 8, 2026
Vulnerability identifier: #VU125430
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to duplicate items and XP drops.
The vulnerability exists due to improper state validation in the entity attack handler when processing attack packets for entities marked for despawn. A remote attacker can send a timed attack against a player entity during disconnect handling to duplicate items and XP drops.
Exploitation requires precise timing during the short interval after the target player has initiated disconnect and before the entity is removed from the world's entity table.
Affected software
PocketMine-MP
Remediation
Install security update from vendor's website.
PocketMine-MP - update to 5.39.2