GHSA-5jfw-35xp-5m42 is a high-severity (CVSS 7.5) vulnerability in pocketmine/bedrock-protocol. A fix is available for pocketmine/bedrock-protocol — see the affected versions and patch details below.
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Real-World Exposure
pocketmine/bedrock-protocolReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | pocketmine/bedrock-protocol | all versions | 8.0.2composer require pocketmine/bedrock-protocol:^8.0.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pocketmine/bedrock-protocol, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update pocketmine/bedrock-protocol to 8.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5jfw-35xp-5m42 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-5jfw-35xp-5m42 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-5jfw-35xp-5m42. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-5jfw-35xp-5m42 in your dependencies?
O3 Security finds GHSA-5jfw-35xp-5m42 across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.