-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pocketmine/pocketmine-mp | composer | < 4.18.0-ALPHA2 | 4.18.0-ALPHA2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from immediate processing of 'MismatchTransactionData' inventory transactions without rate limiting. The advisory specifies the root cause was lack of deferral until tick end and missing rate limits. The fix introduced deferred syncing (tick-end buffering) and the workaround suggests plugin-level rate limiting. This implies the vulnerable code path directly handled mismatch transactions in the packet handler without these protections. While exact code isn't shown, the PacketHandler architecture pattern in PocketMine-MP and the described vulnerability mechanism strongly indicate the MismatchTransactionData handler function as the vulnerable point.
Ongoing coverage of React2Shell